{ "Event": { "published": true, "date": "2021-12-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-06", "timestamp": 1638835381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e13e28cc-1889-4938-b2d0-7eb5da3f3a50", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590006d4-5630-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638752619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638752619, "uuid": "5c37c446-da5a-4d91-9884-8b63706747c6", "comment": "Malware payload (Heodo)", "value": "6c286b4ea6c0021397304914281a68a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638752619, "uuid": "415c1389-212a-4a7b-9867-2a4d98647de3", "comment": "Malware payload (Heodo)", "value": "00f5656c48a29feeb9cfea737b18ac850673af54b05af9f0c0d8db22e3e48a45", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638752619, "uuid": "a4e7c0a4-e268-4cf8-81cb-ce372acbc3c6", "comment": "Malware payload (Heodo)", "value": "86acfce262bfd827af5e7c03e65a291b5ef5a346", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638752619, "uuid": "835fe779-9ee5-4699-9e55-c7c86edb195d", "comment": "Malware payload (Heodo)", "value": "88db2507f8e7d5f591aeea9795ee3bcf802d5c128bc38d7fcb7a4f5d4d15965c7dd5385620a1305e38bf36ea7f272b9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638752619, "uuid": "924d185c-cb8d-4331-ac32-b169457afa55", "value": "T17A05AD01BAC1C032E07F243461A5DB766ABDBC714AB4C39B3BC4177E1F316D19A29B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638752619, "uuid": "a23408bb-2625-4d22-902f-aae03496eb3e", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638752619, "uuid": "3c4d524b-0643-4f5f-80bd-a19c78161455", "value": "12288:HVqLOGNVDzZtIlHN3nkjlXC/j8un/gB9iuD+jv6DEiih24b6WTYGLA:HVqVDzZtIlRkJMjgB0BthxTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638752619, "uuid": "9a86adbf-2df8-43fc-afaa-abe290f655c4", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638752619, "uuid": "5940b7b6-04c7-43c4-8b2a-4ed7bb244e51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638752619, "uuid": "93b3d898-8774-4059-8729-c945203aa99b", "value": "emotet_exe_e5_ae9b4f129468481b7df0270479e34bf7847b4a4f8927e0b8310aa292c31f9f50_2021-12-06__010332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7607d329-56c8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638817951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638817951, "uuid": "9adf3714-7dfe-4122-9db2-1ff900642b67", "comment": "Malware payload (Dridex)", "value": "310442f6536c1f5b5b29b8ea15481a72", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638817951, "uuid": "86ed8910-b9d2-4d2e-9464-ffd96cfca23f", "comment": "Malware payload (Dridex)", "value": "012537189806608adcc4578c40a84129fec28f05ffb14ff7b6b0a8fe8b7c83ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638817951, "uuid": "d39fd994-5eba-4dd5-adf9-675bd3d3fb23", "comment": "Malware payload (Dridex)", "value": "7ad167eaa7136f534201d86806bb3aa3b15dccee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638817951, "uuid": "16a4d973-5100-4137-85a1-998ca8210bbd", "comment": "Malware payload (Dridex)", "value": "de9652b8fdbec0470cdab17ac70619fea5563b434ce37be4e76c0d467367e76822ddb8363ee2954093d8c7b6516536bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638817951, "uuid": "e8f0ac3d-87ed-4b9e-af03-bb4e52821969", "value": "T1F0B3126DE983F036C0AF1470936F7C7AC017B1619515B137A0AAEC1C1646C3AE66FDAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638817951, "uuid": "cd58f103-7fdd-4265-b164-2a7235ac3eb2", "value": "3072:fVSL4AJxJ1td/fKxSKREvpER3yPpIMoMG64zp2JRda+:9SL4AnCQBI3TMoMuF2Hd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638817951, "uuid": "bb606514-6265-4c30-b415-1b3aeb01f8a6", "value": 116568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638817951, "uuid": "0335884e-7207-446c-9b06-2577a0f408b2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638817951, "uuid": "103f78fb-7a42-4a24-ad07-f18ad6cb5caa", "value": "act changes-289631827320.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3c861e-56c5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638816730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816730, "uuid": "85ad603c-d816-4df9-808a-1805e60b4597", "comment": "Malware payload (Dridex)", "value": "d6c1b30e58fee38dc331aa4c51262087", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816730, "uuid": "2d144e18-4970-4bc0-b3b6-ed7eab6bd977", "comment": "Malware payload (Dridex)", "value": "01e8a7c53dc120faefe6d75c59d490f49927a2e42f67cac7d272290d8ae53321", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816730, "uuid": "1debdb49-ef22-4e12-a3ca-439d19754e49", "comment": "Malware payload (Dridex)", "value": "258bb630a0cec8ae599f46bc88c1cb27971ff97b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816730, "uuid": "c6b7e3c6-b39e-4f01-b2e3-4bf1df675f0a", "comment": "Malware payload (Dridex)", "value": "62ad470fc01e8e4367c6221d0b710a2240e8b9a89a588e19c0b200d8c6f1236cf0a0437d5dca5ea12ed50682161a3e6e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816730, "uuid": "f104fda6-f17b-44d1-8848-822d03867736", "value": "T197C312B45D5FA32AD1653CF38885ACF42C710DE6FA13AC362D88D51C328E66A5BD21DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816730, "uuid": "f75d687e-1739-4515-85bb-ea58ded3adc5", "value": "3072:Hnd/oKM7k+JKACVOINAI3xyv9D0tzasQ8ZFLdoL:Hnd/olkoKACLt34+JZFLda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638816730, "uuid": "d03e5570-4b1a-4e4d-8149-4231159dc402", "value": 123907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638816730, "uuid": "8ee0e1da-74f1-4996-adaa-436462dc5672", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816730, "uuid": "fd8bed15-1207-4d56-8547-27a11146c8a4", "value": "act advances2956682434.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282028e0-566a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638777448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777448, "uuid": "3c884fb8-ca83-4dca-ad77-c5b2690365db", "comment": "Malware payload (Mirai)", "value": "1b6f0f873d7f090fa87918b5c6433893", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777448, "uuid": "a21a0940-1efb-4167-a4fe-6f142b3d0d23", "comment": "Malware payload (Mirai)", "value": "0201a458615fa14e2a86d629ddefd5404d63c2e975a4ca4d30841e53693ccd53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777448, "uuid": "28217ccb-ca5d-46e5-8de3-fc37540a1283", "comment": "Malware payload (Mirai)", "value": "190fd8cee000267a5213bb2d773eb1be82a11d14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777448, "uuid": "729a07bd-fd6d-47fc-ad36-75b48d7b3145", "comment": "Malware payload (Mirai)", "value": "d55f486da2382f375a7e374afa1adb0d77ac1cd43bac11332a991f7f22ea327fe6ccb44758a58230fef99c87c78223f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777448, "uuid": "1254aeb4-5605-4753-8845-58a929137030", "value": "T1D2B30A3B7B170F23C0C9507106E31332AAB5D79938B953D7ADD06DAC2F1AA883456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777448, "uuid": "0940be82-45f3-403e-9a61-06e99a714caf", "value": "1536:kjFNIabYqrAAJ3yNM5zltStTZPlcEIcGcmQWFiLsyxOePre:jabvryN8yf9cEIcGcmQWFiLrxOure", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638777448, "uuid": "7e019e1b-05f6-4802-a14e-b68fd3b83c0e", "value": 116492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638777448, "uuid": "a20d763e-31a6-491f-ba8e-6a3dc6ce7464", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777448, "uuid": "82e26ded-d2aa-4429-801f-27492fec4958", "value": "1b6f0f873d7f090fa87918b5c6433893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e80235-5682-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638788015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788015, "uuid": "2b7fedf7-f864-4671-9e00-021e9482d7cc", "comment": "Malware payload (Formbook)", "value": "fce09c3f1d7212c3dfc53b7d28975008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788015, "uuid": "4ac0e2f3-0323-4a0c-8055-ab0ce703c707", "comment": "Malware payload (Formbook)", "value": "02200a888ae3b3b018219697a06804f922e99d2e4e2dc95bbfb6058ccdad069c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788015, "uuid": "f69561f5-e44c-4148-a797-c7a155a5532e", "comment": "Malware payload (Formbook)", "value": "960605ec0b10b02d1927f72e9b7d542cb061bd98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788015, "uuid": "1699c2b7-1710-46ca-8956-b9f10cb98088", "comment": "Malware payload (Formbook)", "value": "d13efb43bc1a6c29450e6e021875292121c7e5095849afc61fd689377437fbc09665bed53c1da1bcaa0cfdd7c1a3d01d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788015, "uuid": "45434cf2-c734-4e12-b170-dd50e446fb56", "value": "T1EA842397E8C485B6C9919DB12437040AE3BB6F3F10B1254B0BA9BD7BB7B35D35019A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788015, "uuid": "7c5a24da-0162-4c0d-9610-bc791f7bacf6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788015, "uuid": "049a5e5c-f632-42c7-a51d-bbb3fc247fce", "value": "6144:jGiYf3tLrQ9JAc5BLTqz8b2BJErhNvAFx6dMVZYfUGNp:wxrQQc5B3CKEErhNv0x6dOZYcG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638788015, "uuid": "44649c25-5441-4712-ba72-3db1744316ac", "value": 373400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638788015, "uuid": "19e5105f-8f7d-463d-a3a9-c1d9cacf390c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788015, "uuid": "8ba527dd-e1ad-4819-83cb-9bbd2d48e4a5", "value": "millio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb87bb9-5661-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638773915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773915, "uuid": "7b59fc38-0de7-47e0-9ede-c44db223528a", "comment": "Malware payload (AgentTesla)", "value": "ed909d0008947d00469e8735e99fe246", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773915, "uuid": "e0e709f3-c50d-4d76-8456-b3e167df0e97", "comment": "Malware payload (AgentTesla)", "value": "030599f802e23cae5526ce4d507e02e810e33bc75eb7059c6fdc53afec9aab46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773915, "uuid": "d77b2c74-4bdc-4ab7-90af-70e6923ac730", "comment": "Malware payload (AgentTesla)", "value": "32a585c0f313e2cd05432fcf6c490d32240ac770", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773915, "uuid": "34e3b926-2231-41b3-b97c-4d2fd43279c1", "comment": "Malware payload (AgentTesla)", "value": "d23786f810fe9a9e8ab46cdec12e79a6e507576085fe860f649818b13589223afa2da023dfaa870af3d8c1ef2b6fcba8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773915, "uuid": "ea3a652f-6f7f-40b3-a755-b226f4e85d1d", "value": "T13F557A1C26B5096BE93D1A74442147374EF26C7D99B7E3CD3B48356B0BB36840A263EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773915, "uuid": "2e9a6b9a-53d1-430c-8cf8-67c736dde8ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773915, "uuid": "2535df09-a866-408e-bb94-c8644d21b756", "value": "24576:7O104zVAy8WNMZh0Mz1N/qh3TIUY8XIbkB9M9g/pJDVmrWf3WsjsPum1beoL6:NObzNqh08LkDLmgB2iZ7vjMlL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773915, "uuid": "98a4328e-71eb-43d6-a6f9-d1327ef0ba4c", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773915, "uuid": "e3e363ff-ac52-4b69-b562-7eb75d0725af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773915, "uuid": "7f43ffab-98d0-4db4-992b-b0d0e7f2cd0f", "value": "Payment Slip_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2308ba-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638802504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802504, "uuid": "55ebe3e2-de09-4ef7-86a9-c5907baf35a4", "comment": "Malware payload (Formbook)", "value": "1352a4daf652beaeeede6e3416630ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802504, "uuid": "b5c39f66-ee33-4ca3-ac1c-dd1ee9a7997f", "comment": "Malware payload (Formbook)", "value": "03067458bf070e3aa4355ac1b6b3b02030a23df959c9b3d6606d59b68cb3c902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802504, "uuid": "ced93e6c-82eb-4edc-89f0-d8d86929b7a0", "comment": "Malware payload (Formbook)", "value": "d7ba3341f14eaf451aa803d19191b94171706650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802504, "uuid": "e902d146-5061-4bb7-8c10-b837c0420b77", "comment": "Malware payload (Formbook)", "value": "fcd73845bffeea63111f0f1df819273717d015b207fe7c0ffff84ba676910ba35adcb89cf75d8b71670db98b74b3a9fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802504, "uuid": "ab5ced22-6b1b-4004-9644-22d344a27215", "value": "T1CD641243C0C4EDA7E9C715B2063ADBBEDFB945DA006A9D539BC02EFB3C355438924689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802504, "uuid": "43f87f8f-6fee-4941-aa43-700a7580fcfc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802504, "uuid": "09ea0937-bcd0-41c2-9500-5139c3968d74", "value": "6144:rGiPz3WPpMNa3KuusNUC2xiKkzMN/R759Vzq3jMYGb6hp:HmRMNaau/aCokW5759FEjjGbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802504, "uuid": "0987991f-4db1-4e38-8fd4-48580ae07037", "value": 314381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802504, "uuid": "e02c604d-fe4a-4f15-865b-291b7a4685e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802504, "uuid": "b331f048-8163-40c3-b4eb-ad1db975d685", "value": "pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdfcb3b-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638776113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776113, "uuid": "715878f1-23be-4d3b-ad00-87fc2eec6dff", "comment": "Malware payload", "value": "f5348421d46972d15e25f871bc07ecc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776113, "uuid": "a63a300b-361f-4eeb-8c3a-1fdeeb8c369e", "comment": "Malware payload", "value": "03614d528809171ea45459ac44783c841827e663322e3fdfe5b3e2477d47a160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776113, "uuid": "09a97fe4-8731-4716-80bd-24fb13ddc298", "comment": "Malware payload", "value": "760074b351752bf974c8726ffde399b71cde0edf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776113, "uuid": "6de0fdac-eb1d-41b1-8995-f4bc4cabd108", "comment": "Malware payload", "value": "9131c550bfa860abaefb4e5610885a96cf132df796816fd5639e079afbc4c92b6683b3d3ebcbaa9bb1151c6c346cecf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776113, "uuid": "0c767f17-66d0-4988-81a0-522b595cccbd", "value": "T160050201BBC188B1E4731C325A296F266D3D7C202E25DF6FB3E4796DDA35081A624B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776113, "uuid": "b8c55220-ad6f-4fe9-af18-1244e5df6e1b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776113, "uuid": "841cc7c8-d9e2-4c8c-9560-a1e8978bac0c", "value": "12288:0Qnk3GDYKGcblwtX+t4Y8v1gZpg33B3XIOMeb9Xg8xgernDi5kivGXk6rM2:IAOcZwXYE1pB3XIOMG1pgerDgkgtOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776113, "uuid": "e2d2b5a1-f7dd-4e17-bb73-2f8cecf08b09", "value": 812071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776113, "uuid": "2edbd376-8905-4302-bd8f-3be96076f941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776113, "uuid": "7f226382-fcc3-41ce-a127-4f2abf3b3b11", "value": "f5348421d46972d15e25f871bc07ecc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8f0432-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778289, "uuid": "36bf4d2a-56ba-4676-a475-f22f07c8cbb1", "comment": "Malware payload (Mirai)", "value": "7f6e0b522b249624637e9e855c115e35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778289, "uuid": "2c20b942-fd6f-4ac4-aa2c-5b88409e511b", "comment": "Malware payload (Mirai)", "value": "049c4a09838d0318da5993b005f331264a06bad7a0b86c2d150a7f986602c238", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778289, "uuid": "3a9ee80d-bb31-4833-bfee-bbdc1c8a99fb", "comment": "Malware payload (Mirai)", "value": "583b7f419c6d4203b621c36ce7056cbda72face3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778289, "uuid": "b3aa1665-d442-4f7d-a414-6c92c44549f8", "comment": "Malware payload (Mirai)", "value": "84c014a11dcd82ae7ce5e4085439fead82d3a9afc706c45e4b1e2f082ef10e75ed8eb70b6f1e83166c58dede14e5321f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778289, "uuid": "be8f00c1-c11e-43d8-b16c-45491cee0dee", "value": "T17413F15DC8ADBCAFCE1E1DB88E8502819578F2886AC911E64700CADD643FFCD3A5D274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778289, "uuid": "f3fafb16-0e46-4e33-aaba-acc6e116f19c", "value": "768:vh/PKF626nVu/Gn3qOY64hFatlFO1lEWPFg2NCuQPqWQnA+DKF53U:diF6NhdY64So1lEWPa3PonAmKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778289, "uuid": "2fdc7cbd-0ac8-4368-add9-20bee5ac4d9b", "value": 42060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778289, "uuid": "b475a16a-4172-45bc-90f9-099fd7d362e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778289, "uuid": "1a2d6314-120f-41b8-a687-a1b99c972a14", "value": "7f6e0b522b249624637e9e855c115e35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531e4c74-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638765064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765064, "uuid": "122f4b0c-92ea-4650-b756-1c259d8bcb2c", "comment": "Malware payload (RedLineStealer)", "value": "f367041f115e0967b4f5cead70f8d2d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765064, "uuid": "86438e47-357c-4c4f-816a-8d58166cb013", "comment": "Malware payload (RedLineStealer)", "value": "051476540fcc5e4a91f315b2ef90c2d91b24bddd7481f73171cedf026a19a0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765064, "uuid": "972fc7f3-577e-4b80-ae2e-a9ff9c38aac5", "comment": "Malware payload (RedLineStealer)", "value": "1eadf1dce8e72ea70ae159b7914c6b689e4c865a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765064, "uuid": "2b7adc70-5769-4f86-8fbc-57cba647c015", "comment": "Malware payload (RedLineStealer)", "value": "48f1da5c7a13a1b51b40b8a8451f4b803f374f7ceca71e0e50226807d070d63323fd639aabb8f233899cc227b55b2481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765064, "uuid": "ea79c660-4c4e-4b6b-a255-c8c1a5bdc13d", "value": "T1627533889BC9FAB8E6862AF9A77DF2375285228151B05314D7DBD452011FD72CA0D3CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765064, "uuid": "9927dabf-1355-48dc-8110-11f40059ca46", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765064, "uuid": "106cd08c-1c2e-497d-a53c-bd6b2568fbb5", "value": "24576:HElM77KXcppdYB1RlKI0mEcgsiU54Ut6XAPcK2z/IZs/t9F6kEaHNYK392ogBw7m:V7g+M1FlH54WQ/z/t9F6NaqogTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765064, "uuid": "e771620c-a3c0-4fe0-84f6-fd7004af4049", "value": 1580760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765064, "uuid": "0e76a3b1-45f7-4fde-8375-9cb0bc2a18e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765064, "uuid": "2db69769-15be-4e14-bf70-b289bb9b723c", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23013.12353.2897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4233c798-568b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638791665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791665, "uuid": "6eb57715-37af-4e48-ae35-25332879805b", "comment": "Malware payload (Formbook)", "value": "8bc4cfe5461872b3ed2dc7b97d723649", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791665, "uuid": "0813c5da-f659-4a05-a40c-32677468b1e3", "comment": "Malware payload (Formbook)", "value": "06590d9c81caf0a4855c2a31c7bbe55a4646ffcb24cb165278e0495b3cf8a250", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791665, "uuid": "c117370e-230a-4110-8bf9-0db826655494", "comment": "Malware payload (Formbook)", "value": "66914ff967f707edd08ec7514a6e15031948cba2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791665, "uuid": "b5d5cd49-4c95-473e-af92-c24379e9d6d3", "comment": "Malware payload (Formbook)", "value": "aa051fe06e9a501e0ff4fcae769b05ce279c271f854390e089920d29b31ba10c9ee8625d05cac329a953b1b955840fe6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791665, "uuid": "c43260aa-810c-4224-9df8-f5f21940f7c3", "value": "T137555A5C317025AFE83A853159541F379EF12C7E866B93CE7307305B8ABD9868F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791665, "uuid": "35796294-76fa-42d7-827c-fdb004208686", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791665, "uuid": "bcfe19b0-3605-4b65-a74f-143de97a9ae7", "value": "24576:kdILP883x+54/KRTKJhvcgpyFiaF+pgJEQJgQ:kGLP88g5gKRT+h0HMaF42F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791665, "uuid": "572425f2-ab88-4408-986e-c7edc26b5c9f", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791665, "uuid": "04dca5e0-6141-47e2-bca2-70d4095e6fe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791665, "uuid": "e34bd426-1f94-458b-bbaa-5b6df7dc10c8", "value": "8bc4cfe5461872b3ed2dc7b97d723649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9413b451-56ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638832604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832604, "uuid": "e304aeb0-abbd-4679-92d9-6caf2685238a", "comment": "Malware payload (AgentTesla)", "value": "cfc46f1ec4d31f9ac76682abaa30f9f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832604, "uuid": "eea44f15-f3c9-4d8e-9c3c-269f2ba41be0", "comment": "Malware payload (AgentTesla)", "value": "068fdcc7bf373ff2ecc0b9f38d2ec1a33582cdcf686a9f6f4736538deace2019", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832604, "uuid": "1600673c-3d8e-494a-b380-06eb0adc33e8", "comment": "Malware payload (AgentTesla)", "value": "e7762fbd2ab1fe7f025350fc37b8924ae0733352", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832604, "uuid": "e71d19cc-0be1-4fef-a1d0-9619cb315e12", "comment": "Malware payload (AgentTesla)", "value": "5e89e6f71bd54e55f944e84ea12f06fa2ba0753f5705645f21a92ebc9bdef27d3254daf359353361cad618c2c6eb7fb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832604, "uuid": "700ac5e9-3e9d-4640-9d8d-dbd3443d9bad", "value": "T169057C2EFD7E6E00E4A80235C4E1A4B091B59DA3A211FD7F6DD436DD0FE06EC5929487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832604, "uuid": "d7a2b42e-66d8-4fc2-ab95-5c9e1bb18f5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832604, "uuid": "5418b77a-f7f7-4fad-acaa-8e16d63fdf78", "value": "12288:Y67sAGLFWIRdCzT2befw/nAl8n7Dj2BRREniBMHbwLEliF3W3mFkp9L/fj318uft:CkLCzYltEOm6ElmWM8jpfD6oi7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638832604, "uuid": "7dd9f275-9c41-4346-9bdc-ab42cfcabd92", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638832604, "uuid": "cc9023e9-53ba-4601-8b79-2e49c88f6da8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832604, "uuid": "c44fbdcf-5d15-4002-90e4-7ce6fcfbce78", "value": "Scan docs. pdf..gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784a06af-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760402, "uuid": "be1e39f9-df7f-4761-804f-ab20d4369b9e", "comment": "Malware payload (CoinMiner)", "value": "3850da296f3c2596aaba5dba02f0b204", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760402, "uuid": "d9f9b228-ba75-4928-9b37-343aacfd2191", "comment": "Malware payload (CoinMiner)", "value": "06c45ab0b5138b4244b4c800264966ab94ee4b5e06c13b58332c2cb792ca58aa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760402, "uuid": "da89d34f-a3a2-457d-b947-dcc39b034051", "comment": "Malware payload (CoinMiner)", "value": "d39cb436d340ad2dc81cfeb2e2aeea21d3a22e2a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760402, "uuid": "165b0fdb-fa3d-4f48-bbc8-d61e6d11104b", "comment": "Malware payload (CoinMiner)", "value": "8e7c42913d6d7226cb9aabbb76ea76c40498d78f41901489f524e1928d759d00bcdaad9dd892a4365c9f8226bda91c60", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760402, "uuid": "ac7490b9-cd00-4218-af09-3dd7a1a238c8", "value": "T146C312F511B42FE2D339D571C0C69630E634BE6ADB962C381F02DD15E213B52CAAC729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760402, "uuid": "44565b6a-f965-4d72-b0ae-0c8dda928d54", "value": "e7decaf25f40094b75c326b377323c79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760402, "uuid": "741bdef8-223f-43a4-b20b-588932cd8b19", "value": "3072:/DPWIZff7cLW7DswVlFjN6GWIeuPGbbpXHPfgyu9pe:jDoL5ar/WIeuPGPp/fgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760402, "uuid": "7a29ecd6-50ec-4c55-b55c-4d40fb556edb", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760402, "uuid": "2ed1deb8-1f46-41f2-8ade-642d3a79d0bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760402, "uuid": "31919d64-455d-480a-8e7a-2ef664f91684", "value": "SecuriteInfo.com.Trojan.GenericKD.38189010.4210.25224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20290569-56c6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638816948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816948, "uuid": "36720796-33a5-48e9-8f1b-b4415dc533d9", "comment": "Malware payload", "value": "071188a257a1ccfd8a02196f2b45a313", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816948, "uuid": "47d937d2-2f8f-466e-96f5-edd0ece9f091", "comment": "Malware payload", "value": "06d5c2627a089f4df0821268cf96d4cf768b97ca829d75a91014b07dfc808608", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816948, "uuid": "f7cb11f0-3e4c-42de-ba07-00d5cd2eb4ac", "comment": "Malware payload", "value": "7d32f667a7ace69f2050bc68547c029c42f13f46", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816948, "uuid": "972c8f9c-90d6-4eca-b8e0-3bf8653a068c", "comment": "Malware payload", "value": "8b70bb1a499a8b6dc2f3342445e151fab7909744bfdc4b04278a27d9ab97156176a87c97822cc96b06421ea34c8b41af", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816948, "uuid": "91cf52f3-19ed-4ba9-9e6d-f54a76b3db5d", "value": "T16CB56C22B2D1C537D0636A7CDD5BA799A5297E201D28880B3BD43E4C9F39B807D2D2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816948, "uuid": "2e8e978b-3839-4b61-b7de-2914ff4b283f", "value": "24576:4rivM6G3C5W5AK4VJTABSvSHkCt0a5ehNZYYM8SQ66ABftL21x/a+/60pATU+WkS:4rSTJjLvSH306AnShtWGTPiGYS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638816948, "uuid": "bb5cb65a-cd97-430e-8aa3-8c8fd0b4d167", "value": 2338304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638816948, "uuid": "72500092-a897-4af8-97ac-b8904af11546", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816948, "uuid": "b36b2185-4c57-40fc-bdad-88f09e8874bc", "value": "Nf-e0001224@&&com##@@.PDF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c5cf0e-5690-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638793714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793714, "uuid": "5d656a02-32e3-4010-a3c3-05967c70ee3a", "comment": "Malware payload (AgentTesla)", "value": "00d80c8168e5318fc53c2647f2f5a453", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793714, "uuid": "ce8fb17c-eb5e-4bc8-91b9-6ee19004f28a", "comment": "Malware payload (AgentTesla)", "value": "06f5cd5d7ea22a4e59f0eefa5f5b3485c7f991734ac9b1ea67af497d74617dea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793714, "uuid": "46148d66-a0e5-4bb8-80a2-a1b5b2025b2c", "comment": "Malware payload (AgentTesla)", "value": "4b81607999f0058b55735c8987cc0492d124daf0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793714, "uuid": "201cce65-719c-4841-aee2-c940312233bb", "comment": "Malware payload (AgentTesla)", "value": "03d917878f6cf099aeaae64a34052a4b680b2d759c86950fe37328a45c2f27b0b2b753a37d6949ecb91268cb4318079d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793714, "uuid": "09817e83-ae84-4fbd-b9f8-e31b1693a9a0", "value": "T16D558B2C25B5096BE87D1A341421473B4EF26C3D9977E3CD3B88355B0BB36844A267EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793714, "uuid": "3a9a2e04-674d-43df-bc8e-d9ad66f4ea25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793714, "uuid": "e9228da1-c331-4c74-9537-290192a3ccfa", "value": "24576:fsYy9gaQofgq7h+GbKkGCB8KYWXiMmQedYsiUMo1yf0FM0bLT:SlfgqwGbKkkVKiMmtdYsVpFhLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638793714, "uuid": "b973eb2f-63a0-45be-a301-65e2f7723951", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638793714, "uuid": "2d9a0606-4a1e-4d17-ae86-b0c5d00147c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793714, "uuid": "748c37bc-e916-4ed7-a6a8-3b1549452267", "value": "PO #8992787848388383778878289972397839820001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f707d9-56cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638820318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820318, "uuid": "923994a1-7f28-4690-8a38-e6fa4c196458", "comment": "Malware payload (DCRat)", "value": "358319a844f5932e60facd3d5c03e788", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820318, "uuid": "29f2f572-ca6d-4a82-a76b-65a577fded36", "comment": "Malware payload (DCRat)", "value": "07aa7e390ecd5d9295b75f8ed032d17e87f91ae8bc05cd6e5e94df2d34d672df", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820318, "uuid": "24b1c8b5-cf19-4708-9a99-609ceb39f226", "comment": "Malware payload (DCRat)", "value": "b0f1f41974672cf08b6abb5caf765bd74cfb9694", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820318, "uuid": "e3c5db78-f175-41f5-a8e5-a9f480bc8516", "comment": "Malware payload (DCRat)", "value": "a984fd99d77b3450848b5da7c5d653ce3203c7a1ece0829012cfe00f58bf4d048d5f9eced36574d88d636a8d5ce1f350", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820318, "uuid": "32db6d47-ccbf-4aae-a396-4f312dc9f241", "value": "T13FA4AE09F798B193E212A13272FFAE38402793F75C892AB1B0D75992E2E15C1D147F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820318, "uuid": "5cb21672-8184-4550-8ea4-eaf9950321e2", "value": "31a0d8a10004949d8bfcc62a3a182b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820318, "uuid": "566b40a2-7605-417e-9f30-e488ecd89f8e", "value": "12288:q53pNO8C+Irh+xnJ7qG4tLj/nmm5JZbvRQtb31mQAjQryKMur:q5ZNO8C+IrAnJ7qG4tL7mmEb3IQAjcyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638820318, "uuid": "33cbab58-e52d-4872-8a2c-8dad490e5619", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638820318, "uuid": "31e42e03-9958-48ea-814d-ddd8b3442a8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820318, "uuid": "61daac96-310d-4c21-8c4b-2806d528cea9", "value": "07aa7e390ecd5d9295b75f8ed032d17e87f91ae8bc05c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43491e58-56bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638812282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812282, "uuid": "fbb18db9-594d-416d-bd78-9b1153e4f76a", "comment": "Malware payload (Dridex)", "value": "833678392144fb4d7c3f66d9aa039f8e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812282, "uuid": "205c03d0-a8a1-4e9e-96b1-2e062d350a42", "comment": "Malware payload (Dridex)", "value": "086590a4e3d21e948f8b828b4117519e07a0723bb8fe554b407abd422eceed26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812282, "uuid": "36819864-ff1a-457d-b858-71448eb0eaf1", "comment": "Malware payload (Dridex)", "value": "bec21dcdaa143bf0a5b4835b682767d1777d15c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812282, "uuid": "63d531dc-2da4-45e7-bbc3-dc32d56e6443", "comment": "Malware payload (Dridex)", "value": "792a795d3695416341a9c34c3b47f8bcb6578445dd3a34d01306f242e35e3d4caa7b9efce76e3f78170419755805c663", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812282, "uuid": "660bde4b-a3f5-47f6-bc61-156e3a74ca0c", "value": "T183B3014E100B0C84C67A3637127955F9770D1A19A87BC68634F8BE1D915A3CA93DBF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812282, "uuid": "a12fafce-ff81-4265-b2e4-910865cec273", "value": "3072:mtg1PtCOXRvYHmvKrguyzFq8fDb/DNijhtcPCUd3I:Nh5FYHhgVBqub/DNMcPCUdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812282, "uuid": "4ee5c78c-29ec-4134-93ff-bb7dabce3e54", "value": 116600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812282, "uuid": "e75b01f0-5753-416e-abd5-80a88e212182", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812282, "uuid": "d0d6174b-31d6-4902-a87d-7af2c5d94753", "value": "insurance updates_559571550908.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9581353f-56b0-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638807696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807696, "uuid": "b758b916-39cd-450f-af79-59419a798d53", "comment": "Malware payload (IcedID)", "value": "45eb2569bc372da7ab895adb61836fdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807696, "uuid": "3fc0cf71-3998-4c22-8212-7f6051271cc1", "comment": "Malware payload (IcedID)", "value": "08686ce9cb918465b8d506c863ace998e94556d4252205038744a5c5d2f5e34f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807696, "uuid": "8a465713-2110-4034-9b19-85f5c9d9b8e2", "comment": "Malware payload (IcedID)", "value": "215f468b4368b401a2735ac5d71c24c1203507c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807696, "uuid": "c43d8526-73d4-4cc0-96e4-09788d000d02", "comment": "Malware payload (IcedID)", "value": "e399f957fb6908324e8287be44d8bf916a683fbeb505e473c51777a35176068f80b5ba36a51cd2d724c461988b440625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807696, "uuid": "08e9cf7a-af23-4370-835d-bab78c194d50", "value": "T1661538AE44CBC59FFEA18838DDA46AE3C293976ECD6AC9F34D8594302C114D9487B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807696, "uuid": "7120512d-3e9d-452b-95a1-5bf7a7de150c", "value": "f6bdd1c75556d961afd6fb8104c342ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807696, "uuid": "aaf6b1cc-0036-4b8c-aeb6-4bfbb2b04862", "value": "12288:HfdCRsouYgpzEvqM8dxJ6IO7ByLErvB67sZ:HYRx8V6IONyLErvB64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638807696, "uuid": "e34eae60-01c2-44b0-8690-6db877fc7b19", "value": 889473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638807696, "uuid": "74e0407f-0504-4553-9981-54031dc56635", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807696, "uuid": "d2cd4bc5-f747-45e0-b7cf-88b35dc84fdc", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7054d3a4-5674-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638781864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781864, "uuid": "f13416ab-3b27-4b91-8da4-a6943ca8cc02", "comment": "Malware payload (RedLineStealer)", "value": "44babb3f43b3522677010f818d175410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781864, "uuid": "80ba9ac3-b92d-4bce-ad9a-1d87370621ef", "comment": "Malware payload (RedLineStealer)", "value": "087203d17c8f1f6250dda06b39ef51a2b2143e51f4ad267d4dee07b0211dd7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781864, "uuid": "dbf4522e-eedb-4c7b-9959-e63b9f0137e5", "comment": "Malware payload (RedLineStealer)", "value": "b1df952119fe9cb518e524200d19f5fc650f2bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781864, "uuid": "25e11885-2c79-4f2a-ac04-a7b2bcff1e1c", "comment": "Malware payload (RedLineStealer)", "value": "797fb9934e99e5e874b63ad582cf5354d085c4bc35a315db24a148d7f7dd5f1cd37eff1a3e70eb6ffd9d115cabe77d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781864, "uuid": "4adc153f-3e4f-4cc9-aa70-2fcdd1c59663", "value": "T148549D2133D0C032D49725364525CBB58E7BB4716A666ACBFBC42EBD9F247C2A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781864, "uuid": "956cf2a5-d005-45a5-a3b1-32dc3e75a018", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781864, "uuid": "50d329ed-124a-48d0-bedf-2fdc0fe05b44", "value": "3072:sydxzCNSguh/y7Kwgu39ZF2JiI1vKgTsVK7DVzOmg3G9JHkb1QHIj5fjhc:lrzmxPuaZElTsoDV99J6CHAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638781864, "uuid": "ce04c675-e256-4a6f-8514-c7a0af38894d", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638781864, "uuid": "6d9419c3-03eb-4339-96d7-0dc9000fa7c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781864, "uuid": "980ba728-e98d-4b27-8e13-51a0d6b1cb5e", "value": "44babb3f43b3522677010f818d175410.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475acc92-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638772346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772346, "uuid": "bb0ebf92-5286-497d-b59e-d1805fb743d9", "comment": "Malware payload (Formbook)", "value": "54693ab7e6a61e5e6d9623ab637aa7a3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772346, "uuid": "e8d675ca-09b3-4e0a-a6e3-c234cf7ba1d1", "comment": "Malware payload (Formbook)", "value": "092dfda0fb57adafb5809f8f6a0bf5d91d0dad02bd7f7e5142ba3293a90f44a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772346, "uuid": "67c5089c-8581-4abf-b978-0a9f233d2336", "comment": "Malware payload (Formbook)", "value": "12fc9f3fa4293520fbb572ab4e6d73ee63cb00ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772346, "uuid": "38903941-051d-44c2-bc6c-2b82cfaf59ae", "comment": "Malware payload (Formbook)", "value": "16f8cb769059bf7edbd758bb055a269e536763f480524879a69100bdd96a558a7ab71e8dbf3b878eca80be95d3827d35", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772346, "uuid": "19178d8b-41f8-450e-99d0-674fcad0076f", "value": "T105341286377A34B4C2F3F6399842D1CA157EFC40F8A4A02AFC087B59E5BB51B0A61577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772346, "uuid": "f809d653-dda0-44ec-8922-69704f6ef367", "value": "6144:06FLsJcqLSn6s855cQnjaSCfaud15KfEsnocvJVf+w:1FLqLSa5jnSG8snoc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772346, "uuid": "986b699f-3f4f-42bf-be55-4ae8b3f9ab3c", "value": 234504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772346, "uuid": "c8978bed-03bc-4b64-8d14-d897710f44f4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772346, "uuid": "6381e827-029f-429e-a228-ef2fd6293489", "value": "Book1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4b7a18-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638812108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812108, "uuid": "a2ae3360-69ff-4322-a79c-e605a355872f", "comment": "Malware payload (RedLineStealer)", "value": "af905c1b0c1c36a80fc5c32ac3b015ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812108, "uuid": "0a78fd03-de48-41d8-bd8a-0737a11b401d", "comment": "Malware payload (RedLineStealer)", "value": "0968fb0d2e59645c5e510d7f195c5fade1624a23d57777f3878245921c3ac752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812108, "uuid": "f3221b83-cb9c-4002-b5ee-6374b9890734", "comment": "Malware payload (RedLineStealer)", "value": "26031c5adec6123bf336d3149208b5d417a3ecc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812108, "uuid": "dbd24a1e-450b-4654-93ab-812963dce134", "comment": "Malware payload (RedLineStealer)", "value": "05ad22dea7c95409930747f7da72db1182fa4ec1e467af9dc337a80f45e39c5a18e71742c30660cdf0dc122963e3c38c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812108, "uuid": "60497cfd-4c9c-4f38-8850-337438bcf588", "value": "T11294D01172C0C072D0A765728D25DBB19EBEB4745A224A8FBFC85BBD9F247C1972630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812108, "uuid": "e73e58a1-0be9-4754-8970-52efb0732db4", "value": "56620115eb6e0830bdf5b4ae97062a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812108, "uuid": "621974b1-da60-4f96-80fd-4f01a3629c4a", "value": "6144:/NOxa811dFKY9nVXDHVEpcWJnEgDowlOES8jLF1D:/Nl81EOVDHVEp3JnI9IFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812108, "uuid": "87cecb45-7a85-4e24-828e-0e26962d1305", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812108, "uuid": "4924cb6d-bf3c-4fbf-a773-28b200b110aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812108, "uuid": "1f9ad65a-4608-4cab-8778-0f5851524576", "value": "af905c1b0c1c36a80fc5c32ac3b015ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580f465c-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1638772374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772374, "uuid": "946a8571-9249-4421-b26a-c8d4e08ca7d3", "comment": "Malware payload (QuasarRAT)", "value": "05603775ae6c66c7207556660da29de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772374, "uuid": "8f7bfed9-97ba-4d20-aaa3-372c17ccafaa", "comment": "Malware payload (QuasarRAT)", "value": "09ac2a0cc0277beb2b85f5d29b4531e65fb1a25e126f89b8a5ad6d0ba04ef369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772374, "uuid": "69e6833f-daf2-403d-8718-f330d4d6de5c", "comment": "Malware payload (QuasarRAT)", "value": "96f1bed1e99e6cd51c4973a8b586f08097009c15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772374, "uuid": "45a33f14-5e26-43b1-911a-63ba335f1dd4", "comment": "Malware payload (QuasarRAT)", "value": "49820eeb0353d15a7df0ad3c8002cb77a32a2578e63d650e8cd336124ced0336577849c2c6028909306157d3c6234bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772374, "uuid": "2832d967-796c-465c-89e2-c599884446b0", "value": "T16BE633BA5C3E43ABD8235231CF0E3C5F672DDEEE6D870A281A654D9D93D20942BD414E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772374, "uuid": "fda173ba-12b4-4dbe-8608-0ecc6fcbb9bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772374, "uuid": "77a7838f-05a0-47ba-9ae7-342532cd58a0", "value": "196608:jAOrv7W3B5BDEEbDM/swDpmDd2lIORnk/sMhHOuVzkl5QORwjPV6XZJhfzNguASQ:jAOL7Wx5F8jEpORnkzOlmicP+tzidS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772374, "uuid": "f8afa410-1641-43e6-81bb-3e389cea4e79", "value": 14445056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772374, "uuid": "7fa4eeab-6221-4aa9-851a-63215c8601f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772374, "uuid": "92baa725-fee3-47b0-bf10-f8141bc22d1d", "value": "05603775ae6c66c7207556660da29de4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f0b278-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638776181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776181, "uuid": "8de6610f-eef0-4b49-ab66-2c9d549b0b00", "comment": "Malware payload (CoinMiner)", "value": "fbf6896d9f7c6a3d142d432a454a648b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776181, "uuid": "780de3b2-6a38-4be4-84b7-efba08e3ac20", "comment": "Malware payload (CoinMiner)", "value": "0aab8ce4c866029e079d882679a78217d23e70baa2b9a9f7bb62bf074b007b6e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776181, "uuid": "7057188a-00bb-4b9b-8543-f161f7e82ab5", "comment": "Malware payload (CoinMiner)", "value": "56dbf17a65cf2421b7c9787dcb5aad4a7fbf82a6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776181, "uuid": "c71eb863-4b08-45e1-bb65-100fdca517b7", "comment": "Malware payload (CoinMiner)", "value": "9540a2677b9257095658f4b0d7c4bd9336cb71d41697977a3468d16970f38c54dbfbc87b4b8103d587f9c3a77b697390", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776181, "uuid": "110c7aa8-f5a9-4bb9-aeda-e6fd9ab1bba1", "value": "T1B86623BE61843328C02AC5749833BD84B2A2951E5AFD897EF1E77BC07B9B425D506F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776181, "uuid": "1c59c76a-8355-4a80-ba47-b61316896cad", "value": "889336afd01a952ba79d1e90fb751739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776181, "uuid": "29694738-4cbf-49b7-85de-6187084ee275", "value": "196608:72bwa4W5IwihP2LdOkYHkqnTEdM2uGHqj:Iw/Sb02LxYYOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776181, "uuid": "7e6b9f74-2bb2-43c5-8f24-ca5015ea2846", "value": 7005696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776181, "uuid": "69e566f2-ce18-475d-b3dc-743544115dce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776181, "uuid": "dcb22199-1c6c-432d-a3a7-96f4729b3947", "value": "fbf6896d9f7c6a3d142d432a454a648b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515300c3-567b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638784818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784818, "uuid": "6aeb6b76-f200-455a-a021-f5fda5c97dc3", "comment": "Malware payload (Heodo)", "value": "5ee21fb03540ee7086173930db58247d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784818, "uuid": "5250b690-9a56-42e6-a811-9f284af60239", "comment": "Malware payload (Heodo)", "value": "0b326199fcfff5c386678dacc4a527c7c84b80727886d983225152ae395b9d53", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784818, "uuid": "fc4a14f4-d542-4aaa-9cfb-5b5b24e53535", "comment": "Malware payload (Heodo)", "value": "46673d5bc671e80863de0851835afa726f820005", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784818, "uuid": "a907c05d-96a5-49bd-85ba-76239fd85ac5", "comment": "Malware payload (Heodo)", "value": "1f607f6daa5ec30e7f3ae773b9968a1102a68654117a2ef4216d97c353ebe4e88b2cb9ab301d676f61b3518f448ffbbd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784818, "uuid": "211b8599-5d07-421c-af2e-c68af4e5b355", "value": "T16F03C02EC6516948C333683EC20884EEB15D2C925046BD1B15A4B38C5BB65B76BCFAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784818, "uuid": "7a3ae3f5-491c-4ccf-a118-cdcf63a10fe0", "value": "768:8h/Mvd5dhTnSHMxmxE7l0VGpevZCw4ofmUxjfC30+kS4QyoX0Vy+w+jc:8hmd5vS+mxE7WlfXYk4pEVyoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638784818, "uuid": "16dfc9ef-0e9c-4d49-937c-ed9571f91449", "value": 38072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638784818, "uuid": "b858b2c0-a3e4-4b09-9997-4b6f7179c1c1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784818, "uuid": "9e275949-d22d-48be-b40b-caa02a0573e0", "value": "SCAN_1003049966111617970044.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce2f099-568b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638791656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791656, "uuid": "1d7ff2c2-483a-4341-a233-d315666bc70e", "comment": "Malware payload (AgentTesla)", "value": "2bcfab9148878f7409070b943caea59b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791656, "uuid": "8f068aef-9020-4a19-adba-965523b3404f", "comment": "Malware payload (AgentTesla)", "value": "0c002b81c804e26afef63976610acf9436c4cdc434a1c3e7da36c3db134ef945", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791656, "uuid": "87039b4b-c7fd-4c7f-b40b-a1c8134c580f", "comment": "Malware payload (AgentTesla)", "value": "7e9128c9b74e62f57219db278b4febfdb78f3d71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791656, "uuid": "762328c8-59cc-45ae-acde-d11692fb055d", "comment": "Malware payload (AgentTesla)", "value": "59529c4705a811eaac36e986e4a039a9aaa887e1eb4c2d5184ea6a2bc3eb1d35188ee4cd75d667b382628d19fa95664d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791656, "uuid": "36d1ee7d-9e33-4863-bba2-a32526d39955", "value": "T12E657B5C317025AFE83A853159141F3B9EF12C7D826B53CE731730AB8ABD9468F252E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791656, "uuid": "624507e9-4331-421c-8d93-2ef31cddf0ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791656, "uuid": "369183c2-3632-4ac1-9621-441613df2867", "value": "24576:IBg/L9kGAaZ9pMYcZoXBBdLr77RVDQPidGXwWFljewUC21pTWy0h6302FBk:IBg/L9kGAa5WUlLrXXdqwWFljJUC219u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791656, "uuid": "6f924be2-2be5-4d4d-bfdb-33da16af6813", "value": 1418240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791656, "uuid": "4e4cac30-bee0-4488-a090-41b3502ab95e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791656, "uuid": "082065c0-6a82-4d1e-b260-e1a393d734d2", "value": "2bcfab9148878f7409070b943caea59b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45451cf0-56a5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638802837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802837, "uuid": "3b718c59-5b20-46e7-b286-f05303be832a", "comment": "Malware payload (Dridex)", "value": "f83c34390634bf9e3c7a78193d91661b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802837, "uuid": "2982751b-7a35-4660-9c52-f6794e138571", "comment": "Malware payload (Dridex)", "value": "0c64aaa054e7cbc3010109061653c6dad9bb71db9531d7cef4d202cb69990937", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802837, "uuid": "43b5ea4d-d71b-4d47-be25-5e0355213f10", "comment": "Malware payload (Dridex)", "value": "e82606d5486f401b7b9704a7ccd3f05dcc3649f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802837, "uuid": "8658a2f6-78fe-4a0d-b348-caa6705a46cc", "comment": "Malware payload (Dridex)", "value": "5b7b483fcbd1a31f2c7a7e0a018813bd1ddf9bce88b6ad8497c6806bfebd00f6e43f3ee49ee27d2ef7f365000797b9bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802837, "uuid": "a30ff7de-b57a-4e2b-bdfd-2b74d34d929e", "value": "T18CA4BF4FEEF690B5FA32F8B174528292E1CB9C752002B7D485616A58FCE4C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802837, "uuid": "3b1c9d27-d14a-43ca-bf02-d708d22b29a8", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802837, "uuid": "c7d629a6-7888-4e41-8d14-87025e2902dc", "value": "12288:XCfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWRK:XCfzehtApz4lzQvzU3H2Jz+BbAt3A1NT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802837, "uuid": "b1111382-d307-4961-afc4-4ee5d42388a8", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802837, "uuid": "8d370331-2dd5-46ac-92bb-fea602b756aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802837, "uuid": "670c39d1-4cd8-4897-829c-9ef4cb93cbab", "value": "f83c34390634bf9e3c7a78193d91661b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc304d5-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638773214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773214, "uuid": "ad2306d9-323a-4d85-b31f-7f775e6db1fb", "comment": "Malware payload", "value": "1d760eb86b1b5472b61d26603b0bba60", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773214, "uuid": "501c300f-7b5c-498f-9387-f5823e3a2a71", "comment": "Malware payload", "value": "0e85aff0a3b963a675b89d302839f9ad0a23a03a7777987b651c7bd5ef54d528", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773214, "uuid": "0de6491b-b92a-41f8-8f19-a810162fad5a", "comment": "Malware payload", "value": "78d52e608748fb3b120e5e64627e39be98763dd8", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773214, "uuid": "7f835a2a-3d50-46ba-a6cc-b8d85592e0ca", "comment": "Malware payload", "value": "98872ada48bf6e06a3654b1d2960902d5047ba18e40690541766ef0e89bdf7a80bb6d7a8542e51a9283065eda5eacff6", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773214, "uuid": "cc66ef5b-9968-41f6-aee8-8a679a72dd38", "value": "T1FD72D03BC817A609F4F3377C4BAB1DCB8F98ED332E51051A1A521A8A48D4F932C63349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773214, "uuid": "05102009-c812-44c5-b07c-1c2aac724e3f", "value": "384:zSPE5KdwhbqNOpR/6xz+hTnBmod+eV3zS5W00mRlNKZTk0nNhENa:GPE5PhbcOuxqtlUeZRDmRmZTcNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773214, "uuid": "f4d9103e-2337-4e40-b952-d6caddde4a4e", "value": 16348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773214, "uuid": "6549db7a-9bf6-45f6-ad74-d94a4e1e2298", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773214, "uuid": "f4a91d9c-081c-4afa-b89b-017a4ffaccaf", "value": "Payment #547949748.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2dfa4c-56a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803223, "uuid": "033c3413-9829-423b-9975-4727965bbddc", "comment": "Malware payload (Dridex)", "value": "9198ec7baef5f872e254564b5ab483e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803223, "uuid": "42251dd6-de6e-40f9-8fab-8d5ebb2b5c7c", "comment": "Malware payload (Dridex)", "value": "0f563add346f7f8f986ab89b26be41a60e9e85bd142d3d82f9ae09a90725f4b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803223, "uuid": "fa18c7ec-a734-468b-b0c7-06087db4bfe9", "comment": "Malware payload (Dridex)", "value": "b66307632b49003601dc16671df883c14ecdd18a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803223, "uuid": "c6b41058-d37f-4fc2-8296-2d1915092c68", "comment": "Malware payload (Dridex)", "value": "6cb5175b111b9f7b1afb09d561d733ddb5707c3c44d61db88ce7b6afd0a150b42127534052f7b91d876e676285d9a7c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803223, "uuid": "2fab17ec-97db-4c66-871a-a28feb595861", "value": "T1A1A4AF67D1A2CB1AF5CCA2F3921A018ADDB64A8482F547D40CE8DC564FB7687F1B0D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803223, "uuid": "b4121f87-86aa-4719-9f06-85bed6780c36", "value": "9259df85dc28e34e237d850d94b74d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803223, "uuid": "06c5f325-8565-494a-bdd4-22744b7d2030", "value": "12288:uGAe6zhjzhVjTJVFRH3m0K0JRkyVnochOENqef6enkeb86t:utDzhjzhVjTJVFRH2L0JREn9zxZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803223, "uuid": "f7ee4156-8ef5-49de-9a36-f7acbd83d1fe", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803223, "uuid": "24fc0d28-7778-4be9-a074-4d7257047878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803223, "uuid": "dfc5eab9-0a22-4fe5-9c83-866ff90d1970", "value": "9198ec7baef5f872e254564b5ab483e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bead1af1-56a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638803470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803470, "uuid": "0ecb0da1-b213-4439-8b4b-7387ae59ccff", "comment": "Malware payload (Formbook)", "value": "eebff5a974213774d330f3a7f3bd1294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803470, "uuid": "c5239ff5-f7c7-40ad-a1f8-6da780405f88", "comment": "Malware payload (Formbook)", "value": "0fe5985d6df4547de4d16044e6f249f20fc9e2b08dffbee1dc9e21cc9e099ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803470, "uuid": "2ef9ecdd-8b0d-4fd4-9456-061f10c6fedb", "comment": "Malware payload (Formbook)", "value": "9865ba6e706ecc907a2c11625ab5f9bc90a661af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803470, "uuid": "0c624cae-3854-48bb-8a1d-83ac75aff94b", "comment": "Malware payload (Formbook)", "value": "42a1bd6cbfb438f0da70d81618ee747742f7fda4c88b67e2fbd432d6e5bf426c2f885f602926d68ba18f056f7166eaad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803470, "uuid": "296ea7c9-2369-4d63-99da-554d971eae73", "value": "T189D4D9D1F19088DAED5B09F2BD2BA53024D7BE9C94A4410C569DBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803470, "uuid": "9c662f65-6a5d-4efe-9d10-1c51a4279556", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803470, "uuid": "e426ec34-a63b-48ac-955f-4eb346d35e84", "value": "6144:oGiEo1qIAfkP4WTZJnl+VAp+3cw0iA84l699PNmCLI1ubY0K0KwQI:cqZWTZJKAp+MwKCUg5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803470, "uuid": "aeadeede-b6c4-4fc5-bd11-a9d4965313ca", "value": 614236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803470, "uuid": "0af7948c-cb5f-4642-83b4-040052feda6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803470, "uuid": "ba8d2b63-43b6-45a2-ab12-60eb7a7aef63", "value": "Kitchen Man Phuket PO #20021612.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe5e61f-56de-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638827363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827363, "uuid": "40b105ab-bdcb-470b-bf94-9720c223a4fd", "comment": "Malware payload (Mirai)", "value": "40a74098a1352aa6c1a7623778b570b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827363, "uuid": "04aec23b-0d09-4824-b5fb-f1fe6d6152b4", "comment": "Malware payload (Mirai)", "value": "100d3bfa7fc14c843389f61cb0326641ba92cf9df9d73edc5b06c6844b30596e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827363, "uuid": "6c2d2417-0568-40ef-85fa-cc5e18cdb0f2", "comment": "Malware payload (Mirai)", "value": "3c6c3843d0b84e5e2296d98e57354b9786353fb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827363, "uuid": "1b45a01a-7b30-4044-81b4-10d5f92f5282", "comment": "Malware payload (Mirai)", "value": "ef5a24c60b851c5f3a3d3d127e70386695c86f2b06a08448e4f95337cc18e0b91ee14eea150626c789474a59bf1f78dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827363, "uuid": "969c5365-79d2-4368-8d7b-4bf73fa8d565", "value": "T170D2E178524B0D21CA3014BEF11D4DC3AB3335FCD2E97937063A2250AFCA65A68BD247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827363, "uuid": "d8ccf707-65e7-4d93-b4c1-85d16824480a", "value": "384:gcjZmBYMhRERCBrDf0CvV4EI42j6HwFuYBlV/t8okzEePCn39z8HNoIhymdGUope:gcjQBkEBr70OedBljuz9ytOeIs3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638827363, "uuid": "14e9b88e-b437-4bcc-ab29-61b35442c7e9", "value": 31104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638827363, "uuid": "b0751879-a964-4e37-b1c8-396522769a41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827363, "uuid": "0fd7cf28-f9b4-4993-be1c-499c3c615be3", "value": "40a74098a1352aa6c1a7623778b570b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbbdabd-5662-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638774073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774073, "uuid": "a7ce4e39-5179-44d0-8dc1-979519f552a6", "comment": "Malware payload (Loki)", "value": "cf7095f7f790691075cc0fa8416b421e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774073, "uuid": "5a7d290b-277b-4d8c-8cd0-3cce80c0f636", "comment": "Malware payload (Loki)", "value": "105c6a65575df97241ddc6b81c72fe929007105cffe748163ce80cdcad8c8283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774073, "uuid": "077784a1-db4f-4910-a8e9-a6b0faae1820", "comment": "Malware payload (Loki)", "value": "9171714663e69ade80b438f65e4b4d5ce36276d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774073, "uuid": "c913d7d2-ac4d-428a-9303-925caf71e6f7", "comment": "Malware payload (Loki)", "value": "8d513ca9ccac6091d2bd0f8f614d51983ecc1255c243546aa57ce50876412c6d23e5b23a9d8ced8fa1dc1ee8a015bdb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774073, "uuid": "b91930df-91ef-43a0-8903-915ec9d0e898", "value": "T1B66423436BD34E7BFDB3043313B29234D269526B0A34A91B9F6C6DD729361A78D252C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774073, "uuid": "5e9d1fe7-cbac-4af2-9f83-ccd7be140a07", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774073, "uuid": "a184e9cd-6c7c-47f9-b994-73c39596265a", "value": "6144:rGizewgFJDaTL2KhJp9EVSl7jni09aCtMB2mSXH0Cw+HOoaRqHaymlzqug9er:HewADkLHDp9E4Nji00CeSXw+HXsrjlG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638774073, "uuid": "a94059a2-91cb-43e8-b335-bae214cd8021", "value": 316766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638774073, "uuid": "08eba6e1-d7ea-4514-af34-c15600509624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774073, "uuid": "b91995c5-ef0b-46f6-b5f4-3039dbe11e4d", "value": "cf7095f7f790691075cc0fa8416b421e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20878dfa-56c5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638816519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816519, "uuid": "1428ca42-7a4d-451d-b2f6-bb493e9e1d51", "comment": "Malware payload (Dridex)", "value": "1accdbfdd9094b6e0e16f05e0ff29462", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816519, "uuid": "968f4915-0cf6-473c-9363-be3a27c27b7e", "comment": "Malware payload (Dridex)", "value": "10f9521a7713fce85a618852e7b9f7a3c0e0b3f6eb6b4bbd689ad7e04aed9670", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816519, "uuid": "877a9369-e259-408a-b52c-481849924a40", "comment": "Malware payload (Dridex)", "value": "e90eaf516513ffc9772f913071d32709aa73878e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816519, "uuid": "dc19c491-27ee-48c2-b2c6-c0ef8a69a89a", "comment": "Malware payload (Dridex)", "value": "315e9395291a4e59482afc7e45b3d21340720e3944310d520e583599f6b4da9d9865379b65bafdfbb11de68aa7668edb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816519, "uuid": "6e063e0f-65c3-43fc-8fa9-71492ed03d67", "value": "T1B7C312BD9D09A33AC2957C3295526EF01C620EAAF9037D3728A4E11C3A6915B1BD33DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816519, "uuid": "720a6c8b-d7ae-4ae0-a114-4f392ab9b4ae", "value": "3072:Nmp/DM7k+JKACVOINAI3xyv9D0tzasQiSkidw2:qykoKACLt34+WkidL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638816519, "uuid": "a2fdd768-bb78-4626-a8ee-a2cdba0e8d4c", "value": 123575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638816519, "uuid": "3050b037-c563-4291-ab27-54b136052e53", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816519, "uuid": "7a2451f5-b63e-4568-a3be-08d1846db1a6", "value": "Details54696410070.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89da1ee6-56ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638805958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805958, "uuid": "b3b8fefc-81e2-42a6-8b1f-e73ecc9d1b39", "comment": "Malware payload (AgentTesla)", "value": "f913fe7eb7e593c0dd545d6f089d6327", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805958, "uuid": "22d2f86e-442a-4694-8297-d0592187ca37", "comment": "Malware payload (AgentTesla)", "value": "10fd89d73b1a84fffb17dc29884d427071ec90aa26d82f9e1901c7ac50170848", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805958, "uuid": "96f8fc65-b8c7-4ac6-99a2-86b6c1ddcf3a", "comment": "Malware payload (AgentTesla)", "value": "7634ad99541a9a1c47fe90aa22c8b74a6a92442b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805958, "uuid": "d383324c-14a7-4601-9956-e9c551af322d", "comment": "Malware payload (AgentTesla)", "value": "44dcc35422b65768b442c546245c504ec3cab452e5f9538237ca51b6c343283bcf9eb750bc065fcc052a2292b2ed2335", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805958, "uuid": "af83898c-ada6-42d3-adf1-56fb44d08d65", "value": "T15545F19936E4745FC81D8AF4E0A41D34937C42A7A08FF3A59EE2F4F03D19B529B26487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805958, "uuid": "dc384c82-8ee9-4567-95ee-550f4c3d2262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805958, "uuid": "f6a29001-a13a-431a-a1ee-55f10437a7c7", "value": "24576:qG9TRgFtCZENTKZa1v4Nh/FwOV8Unh1iQ9KYOS:q75GZAv4NhbVtnhU5Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638805958, "uuid": "55c6e5f8-83ca-489c-a2d1-c8e4d6a80af9", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638805958, "uuid": "562a342f-0c7e-4802-a839-fe512113b784", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805958, "uuid": "e41d5918-1fa1-4de6-a4ad-822f83d62946", "value": "Orden econo-002064.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6ee6b1-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1638789506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789506, "uuid": "29f4b03d-7aee-4217-95c6-395bf3ca3e7c", "comment": "Malware payload (BitRAT)", "value": "9731acc2acbf8329ae69f9d7d50e1998", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789506, "uuid": "d2a8fd18-4d7c-4e54-b271-d1cb9aefcf76", "comment": "Malware payload (BitRAT)", "value": "11dba92af0462cb18ac9c9ed81f104530819287f32be261915b706f83f6e04ad", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789506, "uuid": "f3a4d1f4-29ec-45bd-b80c-3ce078bb7d98", "comment": "Malware payload (BitRAT)", "value": "9d99415d1675f423ebd82551ba1aee7acdccab58", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789506, "uuid": "493eb433-9424-4253-bf8d-c1c2cf535f55", "comment": "Malware payload (BitRAT)", "value": "9c674b16942d71468214d78aff854eec5e7846e0db1158d2f3175359b9969e95aaf8d4b8e08a7d36c2944786051f72e9", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789506, "uuid": "3c6c0eef-df2c-4cad-9ced-c2f9f692db9f", "value": "T118B4290EF702C68AE804DBB4DE772FA11AD4DDB7CC51961BE3497A2E983B7751881702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789506, "uuid": "6d7fbe10-3627-4285-849f-d73842227d9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789506, "uuid": "0f16bab3-ed93-46a3-80d2-82af5d8dfb11", "value": "12288:I+11LQ+rrPVIWM0biTIegqrZz9bEfrPrGS:T11hrrgvTIeLGrPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789506, "uuid": "2dc592bc-a139-4517-b3c2-090c513b0bfb", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789506, "uuid": "8d0a9ee4-4c97-48c4-a8cb-1fa13a61b361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789506, "uuid": "34ab49f6-5fe3-4445-9477-27643096c02d", "value": "9731acc2acbf8329ae69f9d7d50e1998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b524389-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760381, "uuid": "2c4bd309-0751-474e-b516-d5ac4297ed8f", "comment": "Malware payload (CoinMiner)", "value": "28136dc15ca1b1dd3ab945a8fd80414b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760381, "uuid": "2f4cb371-7827-468b-98d3-e6931948cecc", "comment": "Malware payload (CoinMiner)", "value": "123f2358dcdfc715729c8d8fc1ae6a541b54b52133ada197d8140cb8c923aebb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760381, "uuid": "626fbd15-2d15-4282-a30a-11d52fb7de3e", "comment": "Malware payload (CoinMiner)", "value": "89293fb5043c308221c32cf156deabdd42b4f6a1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760381, "uuid": "be14388a-b7a0-4e01-9d44-f2d5f6ad9fdb", "comment": "Malware payload (CoinMiner)", "value": "155e486ff21c3cfec6d7a332739612088c92902e9c74e3219d69e387df054b2c0e1feefc56d2589a335c23b77e56c839", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760381, "uuid": "6780dbd9-7d4d-404d-a964-cbf3fcccd86b", "value": "T16C9533774329EC67EBB70AB462CA47C216C7DF59D3D5CDEB094A307EC60DA272901988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760381, "uuid": "34c7e81d-d3df-4ce3-bfc5-fef151ab5772", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760381, "uuid": "35380c24-ff46-4b2d-8e2b-fd52d3a388a5", "value": "49152:dav9nseVZF2VZavfKzmZ67AnZkqN5wuLNrtj8tKu:d8hsesVZaXsmZ67aZkI5wuLvj8Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760381, "uuid": "b03b9d0a-6aed-4f08-9825-66757b492299", "value": 2040832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760381, "uuid": "a9ebf77b-d663-4a05-a808-e39010d64102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760381, "uuid": "4b74f5b0-c966-43ba-a259-f40371c7969c", "value": "SecuriteInfo.com.Trojan.InjectNET.14.24808.17258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6947a750-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638802468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802468, "uuid": "c5798990-8eb5-4211-b93c-57e5642b0d4d", "comment": "Malware payload (AgentTesla)", "value": "d48d98af3d615a1bcf6c9ef73062166c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802468, "uuid": "8192cbe2-072c-4f30-8407-b22624b57ab4", "comment": "Malware payload (AgentTesla)", "value": "12473bbe3e5fd00ad2c518f0ffb8a17dbe71fa6a4aac77ef15c9daa612a95d43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802468, "uuid": "15e1cb85-13a9-4ba2-9975-5741f7ec8c6c", "comment": "Malware payload (AgentTesla)", "value": "75fd1a337ee426af03e3b342ff87aad4a55da71c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802468, "uuid": "2827633b-c432-4517-9459-e4d88fef526c", "comment": "Malware payload (AgentTesla)", "value": "79f5abce5289f6c1bd992265ff8894ce8f63d8c37e5f94714198784cac9e39d99a8725035a3c8c1560f032f496613ed4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802468, "uuid": "1a1c13ba-4569-4558-bcd8-d39a1da868e6", "value": "T12FA423AE7912967EDC00754B438DB41E2FED205BB5ABC103657423B710B69ECEEA705C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802468, "uuid": "0d1f1605-6900-4553-af65-39edd068e140", "value": "6144:7/I6oqD1JQDG3LTXYCNW/TQn524KlZCu9pZOn6mi9EO4d/o5qe+ltHoXBxhW1/dY:0qD1D3Hc/85Yeu93O6dE1/gKHoj2/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802468, "uuid": "181e40df-336c-4a86-9d12-c35c8e0f6078", "value": 467397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802468, "uuid": "b2512dce-c32f-4421-a79f-ca48a1a535b4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802468, "uuid": "f841381d-5670-43ea-b1e9-b6cd77b53f5a", "value": "incorrect payment information.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a3203f-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638802430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802430, "uuid": "0d3038e9-5629-4ade-8f9a-214589ca3c33", "comment": "Malware payload", "value": "fc470e2ae6025abe9f7cc3c7e6f7a208", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802430, "uuid": "0e95533b-3019-447f-93dc-b5ee0e23ca3f", "comment": "Malware payload", "value": "124aa448cd569453a51eb439b0b23e17cd961b5b3ab266a714ee636143660eac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802430, "uuid": "2706d15f-4297-4a5e-a9a6-f511a447143c", "comment": "Malware payload", "value": "492e1430649ef770d86a3e4d88800e1e2f18680d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802430, "uuid": "37b841bb-bc7a-4086-af2f-69e3931eecdd", "comment": "Malware payload", "value": "bffa06c768ca0b05a122d96e07428b7e5a2f887f8a8698c0e19e4b2a86563914938d638cfe59ce05401cbf9ff4956dd1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802430, "uuid": "411697ff-dff3-426d-bf2e-83719b942d13", "value": "T18BD37D3CE291B4A2DD9A01330643CAC977722D5B6591836EF2253B0D7E70AB8DF21F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802430, "uuid": "ccf9d763-8ac9-49a3-8141-b5183577f474", "value": "3072:kIzVXID32D0Me9kxMFvZUe6ohEQ1Jk0F6:LyyALkSFvCe6dQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802430, "uuid": "ac3adb0c-edfb-4dad-8e58-1e6b41cd189c", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802430, "uuid": "81687dce-9fc9-4b97-9885-b74ba0c17e7d", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802430, "uuid": "82c38edb-475d-4b95-8927-40eb632d0d1c", "value": "build2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e956a6b-5696-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1638796437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796437, "uuid": "452d1599-3e1c-4862-888a-a718ac98105e", "comment": "Malware payload (STRRAT)", "value": "afbdc17c55ce020dae96ab3ffaf0c432", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796437, "uuid": "d9a44d7b-8acd-49cb-9848-6262a07394b1", "comment": "Malware payload (STRRAT)", "value": "138ba8ab63b093c34227d2309aee97032b19563fe69ed1ba018c29bf63ac4345", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796437, "uuid": "d246e506-3f3c-44a5-836c-1d6865761491", "comment": "Malware payload (STRRAT)", "value": "160149389505c797a34c5989a183691ad215adcc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796437, "uuid": "7fce50cc-d88c-417d-85ff-79206f5aa683", "comment": "Malware payload (STRRAT)", "value": "44e1a010031a15310b09598a8a022bf12cd8973d71648ac500ca7b967d351c9838b479cb0d669bbf90a7f12616af5372", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796437, "uuid": "54cadd96-7c69-4180-b7d9-b2ef9487faef", "value": "T16C04BF74C981CA55D76EB23B81FF191C63B003BA90053C8BB52A5D81DFA7F3057EA58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796437, "uuid": "063cd7ce-29ce-46e9-913b-d6e17a676eeb", "value": "3072:TZZPMxpqRIKcluBqGANkjvUeXdvtOuzvOL3Hn:3kxpqR6LGANovvdvEuTOLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796437, "uuid": "6a613600-7b3c-4672-86eb-e22e09664847", "value": 186825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796437, "uuid": "aeacb074-44e8-4526-9ed7-a52644d981cc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796437, "uuid": "76846fa7-f530-4779-8e8b-2bc8d3866aba", "value": "Request_For_Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36dec71-56af-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638807424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807424, "uuid": "67e7f3a0-044f-4d92-a9b9-2c32b5cf4b3a", "comment": "Malware payload (RedLineStealer)", "value": "1a156de40ae3f64580e2b31737b5c522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807424, "uuid": "b05fb4ad-8b15-4a47-90c7-f4694454d645", "comment": "Malware payload (RedLineStealer)", "value": "138c747c207aebd9c05bf699877b25af51a19aefe28dc1ee54513e9a34e01005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807424, "uuid": "40512bd3-f92d-4b57-80b6-c8f53ec36c08", "comment": "Malware payload (RedLineStealer)", "value": "6d607848e86616d1854655db0724652aa46858bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807424, "uuid": "86d7aa89-a77a-4685-8928-7705ab334274", "comment": "Malware payload (RedLineStealer)", "value": "c318abfedcf2b98a22b2ac06bdba9ae6eadaa779e339418683c46aa3b3fb85d361252059a0ee609ee32e3f3b0ae814b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807424, "uuid": "a0bd48d1-582b-4ca3-ad68-9fe7f422c825", "value": "T14A4512026350566BC49F31B3BB6EC618029BACCF6777BA8653813D167E36B0DE52E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807424, "uuid": "139f4cfe-1e1f-439b-bdc0-9283a5de68aa", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807424, "uuid": "6fb4a493-7397-4a25-a16a-7eb42d91c9a8", "value": "24576:M/NvtEl7t+wyJl/vfp63PWbs3jaMyVJKLj6UhA3/NaMh1Z4FbnT1:MzEl7til/vR63ewNyVJKLGU23/NaUQFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638807424, "uuid": "9c70394c-6bf6-45cf-893e-5e8fd76821e4", "value": 1255137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638807424, "uuid": "fb961615-8599-4883-abf4-035928c88b39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807424, "uuid": "50a8b5f9-ff38-47d7-be5f-236f5d3e828d", "value": "138C747C207AEBD9C05BF699877B25AF51A19AEFE28DC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7511340a-5689-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638790891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790891, "uuid": "47d45ca1-0b15-49b9-977a-614c5a4d2781", "comment": "Malware payload (RedLineStealer)", "value": "5efd33d7b3a39a3086a711d3131e64b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790891, "uuid": "969212ac-6899-4e7b-8f67-9acdb01f64fe", "comment": "Malware payload (RedLineStealer)", "value": "140432319c843b675678c2c0fb4d75aead27b109fcfc6fc92c4b91e5c6ef47b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790891, "uuid": "260f9018-281b-43e0-bba5-0115711b6cac", "comment": "Malware payload (RedLineStealer)", "value": "1f26b58acf589a2d2a5b3c1af091dd105bace06e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790891, "uuid": "d2825590-0e02-48a2-866b-0a774fd751cd", "comment": "Malware payload (RedLineStealer)", "value": "eb35cf782674a494c9d8b31d06f4511889f8f107185abda22c1110b70cf8a6a925dee267c8b318a56a6b95afa903aa20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790891, "uuid": "55271096-bd77-4f24-9c7f-6856061a2109", "value": "T160549D2133D0C033D59325764525CBB58EBAB4706A666ACBFBC42FB99F247C2973530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790891, "uuid": "f5792798-71b0-4b62-96c7-9a50dcb760ae", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790891, "uuid": "b4b15e10-34a2-46a4-a4a2-cbbfea57285b", "value": "3072:p1QNhrKaRXhkZMBmg4dNp2q3HJivNgTgpT6ulvt4eXhp/SETTBbcX5PAP:Ajr1RX6M6p/3wppTtvtJpfTB8AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790891, "uuid": "ffdf9a44-db74-44e1-8427-4fa233c7d984", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790891, "uuid": "5ba9cb57-a4db-4de6-9961-e0317840f649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790891, "uuid": "bc99432f-2059-4a9c-9529-f10e1498ef85", "value": "5efd33d7b3a39a3086a711d3131e64b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d220f39-56d0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638821238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821238, "uuid": "c5ea788c-6fea-47e0-9be9-4691a4dd489e", "comment": "Malware payload", "value": "931a9f0dd4ab8c01e8a8630cc3bb0f84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821238, "uuid": "2b61e1bf-82f7-42ab-b9a7-46a46c0f080d", "comment": "Malware payload", "value": "158bb2e668043943e351db28d3ac7a59e0005fd5814549afa2de239fb7aacbc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821238, "uuid": "29622fde-703f-4fa5-ab00-0e95834cfb21", "comment": "Malware payload", "value": "a058d707df10e5a442a702026c5d84bb58d9c1c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821238, "uuid": "6a86090b-5de1-4696-82ef-7c57d9561822", "comment": "Malware payload", "value": "bc1af3cbf224e2d2ee67062ce0bba6923f34d6fbb787dd8d500d62e73a32518d328708a1e4c577a293cc5bcf351244c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821238, "uuid": "089462e0-8401-474c-a1d4-9a817efa0ff1", "value": "T158F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821238, "uuid": "f431beec-fdb4-44ad-9339-3670df619e9e", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821238, "uuid": "904254de-ce4b-43a8-bfa7-2c57d511429b", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/a:JapiKiBEmj4GbOX399Md9J/0TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638821238, "uuid": "0f2e64d4-fb51-4533-88ff-31109c3cb2aa", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638821238, "uuid": "7ffe264c-01a9-4a09-be6d-a29cfba3cb35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821238, "uuid": "694fa972-1d5c-4cac-9954-54cb929348a1", "value": "931a9f0dd4ab8c01e8a8630cc3bb0f84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2eaf4a2-565d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638772124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772124, "uuid": "73f0b918-a438-41b7-ae5d-245f41a80def", "comment": "Malware payload (Smoke Loader)", "value": "88d84c0a35adf66f34639bb292cadaa1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772124, "uuid": "a44bd2ca-e5f5-44c7-af9b-f2ebeec2d237", "comment": "Malware payload (Smoke Loader)", "value": "15d0a00c1b362fa5b65f4690bdcf9fda9d769fa2d5b78dfdab6f2d5a54be241c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772124, "uuid": "b026ee01-3d01-488e-9dc6-e0eda3c6c833", "comment": "Malware payload (Smoke Loader)", "value": "09866c3048328569f5dadfb9495960d60dd1611a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772124, "uuid": "19305eac-f289-4bd6-9095-e6a46a80b425", "comment": "Malware payload (Smoke Loader)", "value": "6309b75772e9cfd95d185f2b12f89f11310b07903599e4a22b78b03879f091557011dff49100b621dcd653c77904ed06", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772124, "uuid": "6f591d79-db03-4065-b2b7-e6dbc318ab72", "value": "T1A954AD2133D0D432D59725364525CBB58E7AB4702A2A6ACBFFC42EBD9F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772124, "uuid": "af097317-d3e7-4891-be23-05f85734ee11", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772124, "uuid": "b9973dff-9747-4406-9013-a6d1199e4073", "value": "3072:AcdZzCNSg9h/y7Kwgu39ZF2JiI1vKgTsVK7DVzDXI62GdQHtj5fjr:f7zmx2uaZElTsoDVIGaHDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772124, "uuid": "72797db4-405f-4bcd-8cca-f0afa440fb1f", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772124, "uuid": "0ec0d561-e147-484d-afc6-d2c02e94786a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772124, "uuid": "ce544474-1ad2-4b4e-b897-27ba57a472bf", "value": "88d84c0a35adf66f34639bb292cadaa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48114a3e-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638811861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811861, "uuid": "7b2f0cb8-4097-47b4-b485-540cd238cc86", "comment": "Malware payload (Dridex)", "value": "1035dbcb557c7723bf66b5e205e30669", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811861, "uuid": "d8ba4e4e-319d-4578-82f0-2080cb5b575b", "comment": "Malware payload (Dridex)", "value": "16cb141bbfcd56edd993b397ec0ce8d56e204656190c7974faf157eaa94d5ce4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811861, "uuid": "f9bed9f1-5f8c-44d9-abd6-40b35ef789b1", "comment": "Malware payload (Dridex)", "value": "da3e1d8717667d85b84f870ac2434a1c834ae5ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811861, "uuid": "1c9a1282-b28b-4dc5-bcc6-45ec4784f6d7", "comment": "Malware payload (Dridex)", "value": "cb70d843e9eecb8c94231b0d6b08a5b8f567218d5cebd271b7f5ea34e8a99b1e61f82ce703ea3b448121b2d0ccac082c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811861, "uuid": "d62df10c-5094-4a64-9726-bdcb9c1abeb9", "value": "T1E1B30209154B8C88C5BB32B3452541F17B0D6E226DB7C19B30F45E3C9A263D9A6EEF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811861, "uuid": "df80c6ae-44bc-472b-8369-45ffe9d21b70", "value": "3072:PZjB3zgMdi1vYHmvKrguyzFq8fDb/DNijhtcIpIpEkndQJ:PZND9ixYHhgVBqub/DNMcemdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811861, "uuid": "aab93edd-d65d-4e0f-a497-74c63adaea95", "value": 115748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811861, "uuid": "b3d32319-4527-4d54-9029-c98c25c433c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811861, "uuid": "a501925e-211f-4034-8db7-2eb56b33f6f0", "value": "act changes12-2021-4056208920.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fe61a8-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638772290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772290, "uuid": "b86f29f1-3410-47b8-b0f3-0a8622df5b79", "comment": "Malware payload (Loki)", "value": "7886cd797567b46cf9ee995211360990", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772290, "uuid": "f7b9846a-7e9b-4ed3-82e6-b78cd810763d", "comment": "Malware payload (Loki)", "value": "170f5e25c6bc984209804a3a78cbfe892e3546e6831a49c6e09a3193ec8b2a2c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772290, "uuid": "64091bef-81c3-4092-9d4b-b575b11ba1ed", "comment": "Malware payload (Loki)", "value": "7a934fad9c753d1aed8d57bbd2c3f4db72f21d00", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772290, "uuid": "e2ec8529-a6de-400d-a233-8abe50d9f1e4", "comment": "Malware payload (Loki)", "value": "f75512812c8ab64133ee1b082c44725b772f7f353ec782a89e6fc19bca1a1cace96de536d5cc3ba0023e6ed13646a512", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772290, "uuid": "511ca54e-1761-4544-8011-12d9cda2cb24", "value": "T1CF341223F2825A6CC4FE62B20EC55D9A480DDF2D0D1BE4FAAC91B44B467EBF54407D62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772290, "uuid": "e4456eb6-5955-497c-bb31-9122998c7c39", "value": "6144:gKOjGyD5yWPR3UMgvcZxRPS8LXawg8VlxRE:65yWPR3UM5wiXaT8rxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772290, "uuid": "76d008fe-5f53-4bc3-9d07-4426c525c257", "value": 234440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772290, "uuid": "d6a02c70-00bd-4ab9-9094-fc7c729ab6d7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772290, "uuid": "b453441d-500d-4124-a5b0-ff8c4eafabe5", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12896da4-567c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638785142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785142, "uuid": "604fc1d3-4357-45c1-a289-59ccf4aa40c5", "comment": "Malware payload", "value": "36238dfe69cac58ace237a00442b3948", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785142, "uuid": "5b71e00e-4bb2-4ff4-a29e-82d11ee4254c", "comment": "Malware payload", "value": "17adcf3dc04eac1a5000c285a9aa6966e6da2b832cb9a2c5d5273678e86cc0a6", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785142, "uuid": "da690825-83f6-42ac-811b-b0a559dab713", "comment": "Malware payload", "value": "db820f0b3ff402bd18e856d32424e10d6b1bd247", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785142, "uuid": "f09a349f-16d8-436d-b141-b5e9c4a38f4b", "comment": "Malware payload", "value": "f8ff49f00d7fb2bffaca9cb961d8ce2623e2ea420870a5209982d732ca1767e7da9624eec988ffdf72878e4a23deb366", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785142, "uuid": "7e6c6d54-08f2-4df6-a042-bb0e0fb60824", "value": "T17E253335A6EE791824097ED8C901C4798AE7C14EA9EE7B237FFC9C879129C31367801C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785142, "uuid": "1cd5dc39-a1cd-4f4b-8570-078e1d66fe61", "value": "24576:ijoGN535ifFGsAs+anNUXend6q3RKNySYmfk5NSJdO:ijoGN5J3sAs+aa8d6q3RKNhvqaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638785142, "uuid": "04731430-511c-44d8-82dc-f4b30cabc260", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638785142, "uuid": "867f42af-3853-40d2-ace6-dc68b0455bcf", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785142, "uuid": "94dfbbac-89f9-4419-8a2d-1e4c7eccb5d7", "value": "17adcf3dc04eac1a5000c285a9aa6966e6da2b832cb9a2c5d5273678e86cc0a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1e472c-56a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803628, "uuid": "c8aaf2c2-c267-4cb9-82d7-64a94c75f23c", "comment": "Malware payload (Dridex)", "value": "1bae05dad555b4eff7f021d86370e512", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803628, "uuid": "14398d50-d1cf-4292-9ff4-2be3c36ffb64", "comment": "Malware payload (Dridex)", "value": "17d3434c35717f1cc1926b06ae19af411b520fdb1e259c1097d264d4f64a2197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803628, "uuid": "b87984e1-a892-4bfe-8f19-35ac792f0d05", "comment": "Malware payload (Dridex)", "value": "fe010071bd212bd509607c782209a6ea2bb96832", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803628, "uuid": "90994bfd-a2fb-4a1f-8516-1cf74eda79de", "comment": "Malware payload (Dridex)", "value": "6bf851d966459ceefcd161406b8d2ecfafbc2e685da24dabe127768fc1f6f32d4ee5a6e446dc6406844cec63415f5be8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803628, "uuid": "9cc6e504-594b-430d-9137-92a7b3c70b56", "value": "T1B8A4AF67D1A2CB1AF5CCA2F3921A018ADDB64A8482F547D40CE8DC564FB7687F1B0D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803628, "uuid": "6c7de99a-0ded-4f85-a46a-8e9642ea333c", "value": "9259df85dc28e34e237d850d94b74d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803628, "uuid": "13e13a54-92a1-4734-975b-ec87b9e12174", "value": "12288:UGAe6zhjzhVjTJVFRH3m0K0JRkyVnochOENqef6enkeb26t:UtDzhjzhVjTJVFRH2L0JREn9zxL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803628, "uuid": "f8fd8c14-c3a5-4a68-a404-1417ef9827c5", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803628, "uuid": "ece3e6ee-5dd3-4094-bccf-e588b13280c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803628, "uuid": "7f520019-b9fb-445a-8ec5-1166c1633678", "value": "1bae05dad555b4eff7f021d86370e512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8cc88e-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638778289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778289, "uuid": "6e2d21fe-6161-40f1-919c-a91faf35b247", "comment": "Malware payload (RedLineStealer)", "value": "596a03177b3cc1fee542a9cd837917ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778289, "uuid": "b8d428b5-67cf-469e-8fac-881f691916cb", "comment": "Malware payload (RedLineStealer)", "value": "186e89f5f7ee63797a2085318ed090b65ef133aad6d8efcf7812590568b22edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778289, "uuid": "e73cc141-9e45-4b65-8682-f1a3038ec768", "comment": "Malware payload (RedLineStealer)", "value": "3f41c582f3bfa76b5fc11f8bf08c48760e031023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778289, "uuid": "42150786-2608-463d-8cd8-74bfa7f8e676", "comment": "Malware payload (RedLineStealer)", "value": "cec8f8a87a8a853ae36bc1b7ef5cb1b7f9e22455c5738e482be3b86bccc3718153a49482232a43c36e7416235fee3f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778289, "uuid": "f7288b74-463c-42fd-977a-157a50ba151e", "value": "T15E150F1F25C38A94FC5B07B657E3B7808BB554D9032B0BC8A744E5E16BF82631F32996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778289, "uuid": "8d41f9e8-6737-49f1-8b05-ec123e98d195", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778289, "uuid": "ea30383c-da2c-43ba-864b-ebd727765e50", "value": "12288:n97AGjMtXNKHIg+dkQVxX9Oe8QMmtT2JmWHI1KOG:9laKEFB8QBzQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778289, "uuid": "0984ff90-d9e6-4b12-983e-8416803c0c68", "value": 902552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778289, "uuid": "b6614fff-43e2-4c65-95e5-8e7faae2d3e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778289, "uuid": "eafe0f8a-f193-4e13-867a-188f9721acdc", "value": "186e89f5f7ee63797a2085318ed090b65ef133aad6d8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3e2ab7-5666-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638776091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776091, "uuid": "4a7039d1-3b49-4b79-a8af-cc96410ae069", "comment": "Malware payload", "value": "e4132b0e2e8a3e1f6760cdd273a68946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776091, "uuid": "7d54a26d-5f14-495d-9ece-18c020b9164b", "comment": "Malware payload", "value": "18a43fcc06880ac6a6beb2458e18333bc4dec989aa7dc484fb1c6eb9ac322b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776091, "uuid": "3f8e5efb-9911-4dbc-b2d3-21bfaa464d38", "comment": "Malware payload", "value": "0ab5367817a301b32ae2328bb5111a35864c17be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776091, "uuid": "69e884bc-a7ad-4d87-b3af-d782b34d290b", "comment": "Malware payload", "value": "6e1c1f25fe61e887eab2772b685bfe618cd49ed903326581adc420b22b2d4a2dda748f10ad52b5a37c0b03c7107b4435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776091, "uuid": "8d3c6b1c-b955-4504-932e-e7d59fb49691", "value": "T100050201BAC289B2E5731D33693E6B15697C7D201E25CA6FB3E8686DDE300919720F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776091, "uuid": "d2db5f1a-122b-473e-ab25-ec019ebf6579", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776091, "uuid": "de60c55f-8c58-4939-9b3e-90566baa2859", "value": "12288:0Qnk3GDYKGcblwtX+t4Y8bmgFzfZgvguPEzcv/Lh6z0D+Xb5eQDbSrzjn0tMy:IAOcZwXYZ+fZOgFyiYsSrzTzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776091, "uuid": "bc64e41b-cddc-474c-a676-b8e70ccbf07d", "value": 866718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776091, "uuid": "6b99290b-374e-4691-905d-e652cc5c76c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776091, "uuid": "4a19ccd6-7ad1-48bb-a5bb-890bb4d0865c", "value": "e4132b0e2e8a3e1f6760cdd273a68946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ed202b-56a5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638802816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802816, "uuid": "61fcad5d-c89f-477a-8193-41f77bb220e0", "comment": "Malware payload (Dridex)", "value": "d8e6401fd8dbceb34b7ab2a118e0dc66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802816, "uuid": "4686518d-9e00-457c-bd4d-6df4238e486c", "comment": "Malware payload (Dridex)", "value": "18ac333e84ab0105867bd3a76128c76fce6c3892f204871c4b746a4309113dfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802816, "uuid": "38368afa-c2ef-4936-be60-45b11971328d", "comment": "Malware payload (Dridex)", "value": "d3a382d6875cc172001d2c1bff6e8a21c71b7a93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802816, "uuid": "f86ecd47-a430-495d-9c53-e2ec9ca9c4a5", "comment": "Malware payload (Dridex)", "value": "ccfb7f815d59b518b77413e5bc461c7f25285b76d6e76f3f2ff1a6d802418b33a14c327e7cc0c274a64797825fce9d0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802816, "uuid": "4b13693f-ee07-49d6-add9-58fd7e47bd57", "value": "T148A4A0469D16A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802816, "uuid": "70d7b8b0-7692-4459-88b6-bff8a2f15362", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802816, "uuid": "aca665c8-2b22-41c7-bfb5-9c7a8ed5a792", "value": "12288:M7fimEsIsmY4K08oM1Wd8t5KQhNdv5zy:M7aVRBn7x6jtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802816, "uuid": "b4a7abd0-88fd-4a51-97f0-72d9fc7752da", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802816, "uuid": "ec6f033d-cf7f-4784-bdfc-03f62cb04c32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802816, "uuid": "411e0782-cbe7-4da9-b815-ec0b063ecdca", "value": "d8e6401fd8dbceb34b7ab2a118e0dc66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f849458-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638772333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772333, "uuid": "5ac6d8cd-b1ca-4440-bad6-c372390d0b14", "comment": "Malware payload (Formbook)", "value": "6c823e6765883e7a609a60bb2539e66c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772333, "uuid": "91344fd9-a9d6-489f-8973-ec1891ce9b79", "comment": "Malware payload (Formbook)", "value": "1a70803889b33f746970ba8d071d74f840b60d9573407f0a39fa9d2112c0acea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772333, "uuid": "2e5a6ff6-b9b9-443d-a8a9-681526c169ee", "comment": "Malware payload (Formbook)", "value": "fee1d36f9551818eb5fa6df9bb9272ac921ffa85", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772333, "uuid": "515ad7d9-373a-4bf4-bae3-53ce5f9e952d", "comment": "Malware payload (Formbook)", "value": "acf0d177f2974beb4f55791bdc9c46b21f2c6a7088555042f8396680e219fd4ba334107ea58b7a65e9040ef40ef0d10b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772333, "uuid": "32f357ea-37ef-46f3-a9c5-59f8fe3e593f", "value": "T1983412017B0851E4DAFA12370FDBC75C592DAE0533AE1AFF50C973A9403B9E9D47A24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772333, "uuid": "9c0239d4-1153-4cf0-b366-10fa0033c8bb", "value": "6144:1SftTnNzhAvxRKNQ8jTL2xWvmYb0rzQT5n8uccvuq:1StT0q9fJvm80rzQ57cc2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772333, "uuid": "bcd3df2e-7e27-4b91-8970-e26fb2d32bed", "value": 234728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772333, "uuid": "6df96c96-236c-45d9-9ded-5502561dcf33", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772333, "uuid": "1c418ce1-9f9b-4195-b416-8c4cab473ca8", "value": "trail order x catalogue.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959b7fcf-56cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1638819722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819722, "uuid": "e8ed6456-eb4d-4845-a121-c15da48794ba", "comment": "Malware payload (GCleaner)", "value": "76bc650e9936e7a08b159d7ab98eecfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819722, "uuid": "32307a9b-ebf8-4b36-b7ee-d727f7401f41", "comment": "Malware payload (GCleaner)", "value": "1b4c7144874551beb52bc3e864822c0b803d0967531addf9612f61898cf2394d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819722, "uuid": "e896f58c-b124-4c59-98a6-381a6faa2e79", "comment": "Malware payload (GCleaner)", "value": "0780566923f0dd8a510b190169f51f178315e06e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819722, "uuid": "dca503de-b51c-45c5-9650-73b27a636512", "comment": "Malware payload (GCleaner)", "value": "47d8f960814b86d653c4d353fe4abc7b3a7da296b5eafc709f10e36c7064d8851b8c08187a9f1fa451d043c7334b314a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819722, "uuid": "1d41f648-a682-476a-8c1b-b5e73b485472", "value": "T16E36337699FA9CF3E7956830A21BD6F37DCA943E05CAEE9863534304D6086B4483C367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819722, "uuid": "3ca995f5-a5bc-48bf-8246-00286cf0673b", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819722, "uuid": "5108800f-f078-4524-84e5-cc23efc7407a", "value": "98304:yQuzTBLXgpkJthNsAeGgRrwhb5mKlkIPahv0SAWtbSTCsIZQE7:yR8QjNs7GgRrwJcqkhcSAWgTCP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638819722, "uuid": "b9618e7b-b9b9-4e09-a93a-a9a3bf831f1d", "value": 5004141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638819722, "uuid": "33d93152-9eec-4aa1-b72c-004c57269e15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819722, "uuid": "73d726fc-1de0-47db-ba50-201298011b23", "value": "1B4C7144874551BEB52BC3E864822C0B803D0967531AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8810913-56c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638818573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818573, "uuid": "39a1362d-c6b1-4850-b6c0-5a326c29e955", "comment": "Malware payload (Heodo)", "value": "98f49f2b471622eb8657ea3b41b1dea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818573, "uuid": "12bed11d-50cf-4a90-a1ec-ba3b11a9b0d6", "comment": "Malware payload (Heodo)", "value": "1bd42ab923a149b2558f6330610b9b025bf585d0e35d46af019c04f44bba884b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818573, "uuid": "2d456399-4abd-4a29-9f9a-1162f85d4d3f", "comment": "Malware payload (Heodo)", "value": "d5d6eb6ada871590a99c448319e1643552995be5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818573, "uuid": "b3852fcc-2fcf-48d3-a1b7-e46ad2e76e5f", "comment": "Malware payload (Heodo)", "value": "f50317fa08de612e234beb7ff9d7668fb246b88d66f30e5e8afca4268b49669a0bd82e246cb136067c695535a673660c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818573, "uuid": "eed38b06-e062-4594-8c54-658755afaf38", "value": "T1F2F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818573, "uuid": "5ad8a29f-0d4f-4a05-a539-e9bb39756219", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818573, "uuid": "941724da-9746-4e60-b506-4682b64319db", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/h:JapiKiBEmj4GbOX399Md9J/0Tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638818573, "uuid": "5a175d1b-92ec-4510-b149-beaff00f1f96", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638818573, "uuid": "a1b6d6a7-113f-44d7-a478-cfeb26ab3b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818573, "uuid": "d110c26e-3e70-4843-bef0-7af4465b60a2", "value": "98f49f2b471622eb8657ea3b41b1dea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f36f519-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638811819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811819, "uuid": "085bbbf7-8804-4c11-9915-a25ed3a6dcbb", "comment": "Malware payload (AgentTesla)", "value": "16223cd0027c2f6a83882ce6c3d059b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811819, "uuid": "7a6d5c5e-eb7f-452f-9068-b7dcda855e33", "comment": "Malware payload (AgentTesla)", "value": "1ca98eb48f6147f3e441d882595aee97b98d450375e0c0df14fc61d6b115d732", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811819, "uuid": "cc61d234-1fac-414e-8583-3fe76a181806", "comment": "Malware payload (AgentTesla)", "value": "de107d1579fc1eca74e3d3fbdb7f14a0069588db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811819, "uuid": "ce9aad3e-5c25-42cf-b135-50e36fa1c06c", "comment": "Malware payload (AgentTesla)", "value": "4c00d4830d37eb32b4a17b4340198f8991824223a064bea7cd1857e4cdb32d5ae142e86d5764d9f3ab65c36ae62e9bae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811819, "uuid": "87fca91e-476a-4558-a72b-3faf12ebbe77", "value": "T150A4DF453AD9D288F83FEBF50CB075C107B9F1E4EA81E2DEEDC42456A862B954F40672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811819, "uuid": "95d0d020-2d43-495c-8917-434a78d80882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811819, "uuid": "4dc0b9c3-3c8a-44d1-96e0-87e9ac577286", "value": "12288:2gwa2iNBDurKrDUsRrDvX/MN0IYuJG6CQv:2gwa1nC+rDUUXPMCluJG6Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811819, "uuid": "bd8496cb-9d8d-40bf-8e22-4fdbbdb0454d", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811819, "uuid": "fb7ca655-521b-4441-917c-d8a46fb2e96b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811819, "uuid": "5d3fe32c-6977-4e7c-a3c5-b4611a6da11c", "value": "16223cd0027c2f6a83882ce6c3d059b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49eb51b0-5663-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638774498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774498, "uuid": "9101205f-9175-4381-acfd-3201b73b64cf", "comment": "Malware payload (Formbook)", "value": "af112badf65b6d025a07fa95da6e9f20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774498, "uuid": "29135ab3-dd5e-435c-83ee-8898324b38e4", "comment": "Malware payload (Formbook)", "value": "1cbfaa8a18eb1b6aca5e3e487fbf74b278473d8be3caf45242a67ff6a1f58856", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774498, "uuid": "19459a28-4d30-4f52-99af-72e1ddbc9572", "comment": "Malware payload (Formbook)", "value": "a7465fdbeaa1a60129ac3320a815e9ebdc7ba3c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774498, "uuid": "3befc340-c6be-44a9-92a0-0c2438e407b6", "comment": "Malware payload (Formbook)", "value": "5884ce962b9d7e055bd102ec69474a44241f7bc9081fea21b7cd772d5ba29e17333bf30c28ef0aa1f6a74ee0cdcb1822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774498, "uuid": "ebabd3f7-5345-40f4-81e3-e6a2f7927818", "value": "T1DA55BD2C21754967ED3C1A7514428B3B5EF04C3DA9A7E3CD3B4435AF9AB16840F2A2ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774498, "uuid": "de66818c-04c4-4f60-a942-074220008035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774498, "uuid": "46e1ffc1-e2d3-41af-b96c-6f665671f11f", "value": "24576:YcHC2MP6Pct4dJa1gZh9RRzSB9Ygr/Gd4jnf/g2RqQf:YcUAsg9MF/Z/g29f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638774498, "uuid": "bd8b495f-8b46-4e73-8c7d-62499c43fd87", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638774498, "uuid": "48f11aa6-5f71-463e-bfd2-dfb8e8bccbdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774498, "uuid": "302e9e55-e451-47a1-8c4e-3f4cb80b9a34", "value": "af112badf65b6d025a07fa95da6e9f20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d9ab8a-566f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779944, "uuid": "82735ecc-2b95-47d6-a60e-fd575d1d57dd", "comment": "Malware payload (Mirai)", "value": "f2e5c1db5ce061fe932e16db0048495f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779944, "uuid": "672dec26-7f60-46e4-871c-a2805ab82a40", "comment": "Malware payload (Mirai)", "value": "1d55aa38c09e8478c22ecbef650f81f41d3e731d09855df6f5a39733b09ff4a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779944, "uuid": "4f8edb2d-9cc5-46da-914c-a74ba5899c2b", "comment": "Malware payload (Mirai)", "value": "bf794b10014768a42608196c5929048e75c2bdf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779944, "uuid": "08e38a55-1200-424f-8168-002adff05195", "comment": "Malware payload (Mirai)", "value": "a7f7e848f411428fb52e49fd2c2cd13769cffe0a9df7c5e1ba84f3c004f96f42786716441213965b6f7bb3e501cec3d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779944, "uuid": "40f06c6c-78c8-4467-b785-8e681f6098b9", "value": "T100B30905F9418727C2D327BAE78E438D3B36579457DB33116A387EB42BC27982E39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779944, "uuid": "37864ce9-c42f-479e-8c73-3ab677327af0", "value": "3072:IfA+C36bkBwH1eH34VkmdmLtadzzDpEPS0hlHTyCaK:U8iH1eHoCmmLta5DpEPS0hlHTyCaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779944, "uuid": "14e32525-9a6f-4d89-8c81-8b1d8ee6c323", "value": 117932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779944, "uuid": "154deaac-323d-4cb8-ac3a-3a6abe389f1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779944, "uuid": "7fa4169c-b7a2-418d-998c-fe91cfc223f3", "value": "f2e5c1db5ce061fe932e16db0048495f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba3292c-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638775574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775574, "uuid": "fae3823a-9669-45fa-93b6-dbe3bac9ee5d", "comment": "Malware payload (DCRat)", "value": "a5f0b192253276d3c3b6f661f7e451de", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775574, "uuid": "bfb4551f-a3ad-46af-920c-1e9b3a6f9675", "comment": "Malware payload (DCRat)", "value": "1d5a04cf9b35555bbd47e9c731b7b58fc7c61f78e220f0b29bae9a2fe24a2e5a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775574, "uuid": "7e7eabb7-e769-46c3-b0d9-2235ed013960", "comment": "Malware payload (DCRat)", "value": "7803c6da82a5603d9e9d30eaa7960b04bb631f69", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775574, "uuid": "4adeb678-2baa-40c9-8631-93aa90220d9f", "comment": "Malware payload (DCRat)", "value": "f157144b24c39e1123795e8b9a53ed25f408e36dff5d2c32169870cd47649bf295e75fdb0484c7d606520e3a9197387e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775574, "uuid": "a0a4095e-e45f-43cf-8287-b88b749951bd", "value": "T146847C1837EC4F15F1FF97BAE4B25861E3B1B457AABADB0F4C8150A90822340DD45BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775574, "uuid": "7e73c4d7-e030-4243-bec9-b0fbeb2b0346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775574, "uuid": "7b9ed44b-3975-4be0-af38-587620bf8d02", "value": "6144:NqqDLO77XGcsqpbSJKmqEQiDWhr4Hwb4gWHtbNfHRmlb6C3YQ3Y:wqnO7rGcNOJJiEHwcNHtBfgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775574, "uuid": "6b8c7ee6-9de1-4753-8e2f-7bc4b9dcf45f", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775574, "uuid": "4345514d-d2fb-45a4-a638-94e11df0c3b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775574, "uuid": "0c63a34f-19b2-4369-8268-c5ccff3f37a6", "value": "a5f0b192253276d3c3b6f661f7e451de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0589fc51-568b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Adware.Generic)", "timestamp": 1638791563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791563, "uuid": "a75c471e-a43f-40c2-a661-1ccc9d0ab6cd", "comment": "Malware payload (Adware.Generic)", "value": "b3fdf6e7b0aecd48ca7e4921773fb606", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "yara", "colour": "#3A936C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791563, "uuid": "2930c085-bab8-4b59-b7d7-5506f3565316", "comment": "Malware payload (Adware.Generic)", "value": "1e2f2a8fb52d3972b9b65b8ad1bebb66965c47a2994f89b3d652c31e6f6e4c3c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "yara", "colour": "#3A936C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791563, "uuid": "5d9e4771-cefe-426b-98b7-04fe4707f504", "comment": "Malware payload (Adware.Generic)", "value": "55283ad59439134673fc32fc097bdd9ae920fbc6", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "yara", "colour": "#3A936C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791563, "uuid": "9cac0a35-9dfd-46d3-87f0-23b355cdc5ed", "comment": "Malware payload (Adware.Generic)", "value": "9473ea097e879cc7068b7d9a3bcd61810df490e0ae3b2fd8689ab9da99727ad972e687b6eb78155f714d1e43fc26e7d7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "yara", "colour": "#3A936C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791563, "uuid": "ec836618-cde4-4deb-b258-5855bef220ed", "value": "T15D3533485B850273E8A15330DEBF4E9AD173BD786A11E87B3B208FBB683D519CE05572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791563, "uuid": "ee460ee9-bb8a-46db-ae36-a5bedf85d29b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791563, "uuid": "2fb45a1e-e3e3-4d65-bdbc-69bebc24c5e4", "value": "24576:c7Rz+6GVlkicMgH6I7kuF7Xc+qaM9oXDEmHbGrXjk5rOTm:E+6cY75ZLqaMsDp6ro6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791563, "uuid": "ecb984ad-cda0-4332-9409-c7b0f38d1230", "value": 1110476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791563, "uuid": "9c0537b4-b774-471c-9df2-5b5abc891637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791563, "uuid": "f1aaee30-f1e3-4bff-af13-664bd2baeaf4", "value": "7z920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e148f05-5676-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638782638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782638, "uuid": "ed520351-3c59-49f3-8b4a-bd454cccca19", "comment": "Malware payload (Heodo)", "value": "054c2ebbafda21d25d8f6ae17a2108ee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782638, "uuid": "5a628104-67f4-45f8-b249-2790235c3cc1", "comment": "Malware payload (Heodo)", "value": "1eaab6cfd620244e7024a5829136d308c2ad913350ced58b2cc8dec68cbce545", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782638, "uuid": "d47b654a-8c63-4ea0-b2f2-c0041f029d20", "comment": "Malware payload (Heodo)", "value": "e809c89d7a34b2b6ff5c5e8e220e45a8da24b8ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782638, "uuid": "a6dbd6a5-4391-4de3-b781-e978e1258d4d", "comment": "Malware payload (Heodo)", "value": "6e299b752035ec91f09fbf079ac59ac58aa2862fec70f25edbc385fce48ac5cb39e40fa4a8792682499665ace797ad83", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782638, "uuid": "6ea11f59-54fb-445a-bb88-c26ce37d0b13", "value": "T1BFA42A04D910A12BF9E251F681AF92F585380730236550DB93C4AFADEF726D9BA31F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782638, "uuid": "c7ac6082-c003-4fd5-88b9-82bb465b4d04", "value": "12288:MFAFMb7rizwAdyEDGShVffy/E/pf/0ufbuyn+Y:MFpGzwCDD/Lff9f5/nX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782638, "uuid": "8b042797-4a31-48f4-80eb-157f12e45256", "value": 464274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782638, "uuid": "b44daec7-cafb-4dab-ba39-0a54857cfe1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782638, "uuid": "bc61f1c6-4f26-41fa-944d-5731563899b1", "value": "emotet_exe_e5_1eaab6cfd620244e7024a5829136d308c2ad913350ced58b2cc8dec68cbce545_2021-12-06__092353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cffddc-56b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638809252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809252, "uuid": "05361e5a-b735-425a-ad62-51009993b799", "comment": "Malware payload (Heodo)", "value": "1d82709e4d92cce770b72c1660ee1a83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809252, "uuid": "dbf022b9-9b25-478e-a89d-5426afea16ee", "comment": "Malware payload (Heodo)", "value": "20cdfb2f96f41a93328673725ce2a5e0e8a283daf37ed94877613f640b01358a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809252, "uuid": "b8fd4678-0b00-43ff-89c0-b927e8ab2510", "comment": "Malware payload (Heodo)", "value": "4fffdf945a8a3bc2c953f6db7d7acbdc35e1d70a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809252, "uuid": "f915daf1-53d9-4b85-be95-910486b314b6", "comment": "Malware payload (Heodo)", "value": "2e7854f51003fb18fc59ccdff155b91100d5d67b5bfb6d80ac6d0b7a09dc1044210502ed2b3b03ebd28517cc20daeb3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809252, "uuid": "73e4d345-1dd7-4505-a0a4-01c4564d9553", "value": "T104F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809252, "uuid": "dc81af3c-e62f-4f66-9a60-4f2f3869d19a", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809252, "uuid": "384d8606-3ffb-414a-813a-99ecca119683", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/M:JapiKiBEmj4GbOX399Md9J/0Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638809252, "uuid": "352d6ff6-52ec-4ecd-b9ab-a7600c98612b", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638809252, "uuid": "9345e29c-7b42-4be4-bf92-180cf65af446", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809252, "uuid": "86a1f9fe-d3fc-4763-99af-ae4e76b418ef", "value": "1d82709e4d92cce770b72c1660ee1a83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0b745d-5687-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638790124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790124, "uuid": "0f967c7c-1e99-48de-9da2-06b8b422af31", "comment": "Malware payload (Heodo)", "value": "48ccf3ce5ee3b0fbb06033eccbaa1f19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790124, "uuid": "71b7523f-88e5-4f7f-9382-01935e9e55bf", "comment": "Malware payload (Heodo)", "value": "21a9992e07a43609caf699997cd3369cd83f1a133c7d0947d825a63740c065b9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790124, "uuid": "a964b9db-b638-44a5-bebd-616ea88c6d16", "comment": "Malware payload (Heodo)", "value": "1b926d131f2ebf8fe773402856be4e5835f6425d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790124, "uuid": "2c9fc9b3-6c1a-4131-bbce-1650444712f6", "comment": "Malware payload (Heodo)", "value": "46a63c6519b9d54c3088536b86cbacc6b9c723d1c7e77ae9433b0c5bc77bbae1188cbc56cd91bc20b1a77080c9546fae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790124, "uuid": "3bea91f9-c262-4953-8888-cfb3614c62c0", "value": "T144F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790124, "uuid": "269c03d0-bfa7-4123-a229-d399c649c30d", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790124, "uuid": "b1174c82-953b-4a6a-b04a-b195d59d252b", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/C:JapiKiBEmj4GbOX399Md9J/0Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790124, "uuid": "fccae3c2-8951-4266-a14b-ac930c115fa1", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790124, "uuid": "09021517-f0b7-404c-907b-9faa54eebfdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790124, "uuid": "0faf36c2-7697-4cf3-9279-d3ae45738e7b", "value": "aJZc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84940630-56ad-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638806379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806379, "uuid": "1e93ec79-9c89-4e78-aa1e-4bf758228c51", "comment": "Malware payload (AgentTesla)", "value": "2961e53b8a5972ae5e9669921421d7ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806379, "uuid": "1f866b18-dd68-4df6-8155-bdb020cf48bb", "comment": "Malware payload (AgentTesla)", "value": "21d0b814dd90584fae06e0becf106562bb491b951902de6a05d66d0b41c5d855", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806379, "uuid": "61a1d6c4-eb05-433a-a98f-66532970bfba", "comment": "Malware payload (AgentTesla)", "value": "1ae5fff8aa6ecf2a087841a0d62b3523cae05f8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806379, "uuid": "bc4713ef-d0c2-4b11-8f50-7de916827f8a", "comment": "Malware payload (AgentTesla)", "value": "abb4d5371605e3628285ba3adad211d838598933bf766078bec24170143cfea1ac7b51472e536a675ff98a0328f0c865", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806379, "uuid": "b1522fa7-805c-4f78-8d2a-bb815eabf96c", "value": "T186B4E04625C5D7D8FC7FEBB90CB5B1C20378F6E4E980E2DEED84255AA8A37504E10272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806379, "uuid": "775ff198-e179-40ab-afc2-1fc341c808db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806379, "uuid": "e7071b2c-caff-4064-97fd-e29da3951e00", "value": "12288:4hXma2iNad7HGajbf8Y6F4GQz/Ms/pGjbXc9:4hXma1i/eFbGMsRETc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806379, "uuid": "870de22b-1c83-48cd-a9d9-be22d12db9e7", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806379, "uuid": "e4468293-afd9-4796-8552-df53f06ca8e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806379, "uuid": "ab9e768e-092f-487d-b1c3-39aaaa15332d", "value": "SALE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7286ae5-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1638789687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789687, "uuid": "465e2395-9424-4281-8412-50eda8c26ff9", "comment": "Malware payload (OskiStealer)", "value": "f4c97c2ec7d1f9c62469397486c6176d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789687, "uuid": "780f2432-eb72-4d2c-a841-b07be493f533", "comment": "Malware payload (OskiStealer)", "value": "21d9ecfc682503aaced06530ef4b4d618ae56966168330d868ef8bc97f72d97f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789687, "uuid": "cd171389-7773-4218-a5a8-e9712dd92c2b", "comment": "Malware payload (OskiStealer)", "value": "0ec8a213c61159b3e34d87b5f31f07fb0beb4990", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789687, "uuid": "3b0bffa0-2502-4964-bf77-bf0f7932f2db", "comment": "Malware payload (OskiStealer)", "value": "1895bd860b171345119c0cdcec5f71625f0818b1ce8259706c24d88fb9260e4e887191d543df6573225d254ae43bbc8c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789687, "uuid": "fefc2e4a-2285-48fc-906b-ac38e47d89a3", "value": "T19C72DABDD06706988F89A7B8272BAF46058CBA1DF789A532367CA77417D1D3B501383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789687, "uuid": "1bd6d74e-a0dd-4dae-b48f-1fe5f1af124b", "value": "384:0s+tYgUi8rjRgxGN9fsahEHzA9B0B8ZKELtyf:0smXBQ9fJEHzdIEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789687, "uuid": "3e58815b-ff6e-4208-8d70-7a11728a2680", "value": 16033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789687, "uuid": "1df39fd2-ceb3-4106-8a71-df95e09fb17a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789687, "uuid": "e7cbf838-9c4b-461e-8c1f-69fe4a90db3c", "value": "Order .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815f6ed7-5671-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638780604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "cd553e42-ff8b-4efd-8bff-9dc58e2da5db", "comment": "Malware payload (Mirai)", "value": "81071355d3c31114e8f165ee4481e395", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "3fd48871-d40a-45cc-8d05-dbb7b979997b", "comment": "Malware payload (Mirai)", "value": "22b45478dda804bbe949fcacaf7d5e424099c0c82fa7fcda14643d20d15afa07", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "fb580033-f784-453c-9182-deedaecf0121", "comment": "Malware payload (Mirai)", "value": "9c95803323dcdbff5b95d59b6a719385e88ddcad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "74bc4dee-ec07-4a71-9896-1e8c29b8a626", "comment": "Malware payload (Mirai)", "value": "05bf73446bc817a2b95af6222d9d8f76107aea9e8a185685462271411a43c639a5be510121c996f53e8927de4d0c6807", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "163fa85b-9dee-4950-a7ac-0ecf60bb6a05", "value": "T1BDD3952E7E12AFBEE668863107F75F70879521D237A19341F26CD6181E7124D1C9FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "a13dc9c7-75f4-413c-be7d-6d4ce28cd4f9", "value": "3072:is9hJ9udWRhxj0CSwRhxj0CSukoQGNPjHfFkXuIF5JCl2PWd4n3jC7w+nUSJ0S9n:ayW3sOS6S9YDgDsdxJ1ZPJbRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638780604, "uuid": "e9ce7f93-c1d4-4704-9bc4-7d63568aa4fd", "value": 139641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638780604, "uuid": "a1ee6e2f-b544-467f-8b1f-e438aafa6ac5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "29bf3c8c-beeb-474d-8181-ab91ac46dc77", "value": "earyzq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c39d94-56ee-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638834246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638834246, "uuid": "6991fc81-2919-47b3-be31-78184ba5858f", "comment": "Malware payload", "value": "e77221d7a4b47b9107ba1b61a551ca89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-norton", "colour": "#DD01CF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638834246, "uuid": "019302a5-512c-4158-885c-028d8071a807", "comment": "Malware payload", "value": "22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-norton", "colour": "#DD01CF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638834246, "uuid": "bf4a98a3-0a95-48bf-a183-af64610589ed", "comment": "Malware payload", "value": "95c5ae3fec0d900e4634e11b3ad81971e78e2b31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-norton", "colour": "#DD01CF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638834246, "uuid": "f0dc3f0e-47fc-43ad-94f0-7cd638261a0a", "comment": "Malware payload", "value": "6fa93a922c503e98895a00f7b0c646df1996dc03967d4042b02b0aec6c76cfb4f51e164750281cea90ea8dae9b2130d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake-norton", "colour": "#DD01CF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638834246, "uuid": "9ce39e1c-d154-4652-b35d-5e182947229e", "value": "T191073364FAD8C1FFC14EB6BC9A546F0B0B4FA418050983445A69F0DCB9E9D76B91B2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638834246, "uuid": "5071556d-edbc-4b64-ba00-8b838e8b9730", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638834246, "uuid": "96be91e1-8624-41ba-b68a-a881782a83ce", "value": "393216:JRoKCcQvnMSJ6zvNtzVqh5k0JBUQzoYfh5Y8B9u0JPG8Z+a9:J8vBgzvNu5BztZy8Hhwk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638834246, "uuid": "6b9a4730-6665-46cf-8d59-c335f1035dca", "value": 17461114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638834246, "uuid": "b2065053-837b-459d-8887-5ded9989b41b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638834246, "uuid": "daf9acaf-52d0-4283-9378-f23ee04eab33", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27b5e11-56ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638806053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806053, "uuid": "07f80cf1-ff9a-47d1-90fb-e5334b88350e", "comment": "Malware payload (Formbook)", "value": "dfe6e5a9716394631b7f098f22c5d76a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806053, "uuid": "3c5dd0f5-a35d-40a7-ba92-0f6f575df3d1", "comment": "Malware payload (Formbook)", "value": "230f4505ad7562cca72358dd27f3fd1f3ce4bf1474913b7c4589acdded64d425", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806053, "uuid": "d140586d-7d01-470b-a6da-b9e263990d73", "comment": "Malware payload (Formbook)", "value": "436e624aa2a3931cd28683829e511cadd158d0b4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806053, "uuid": "3d5e2ad2-1872-4144-a788-738b75a79e02", "comment": "Malware payload (Formbook)", "value": "b23b6ad5bc2d169973305dcf8349a119c895133ee387bb8c3f1b67bb3a2e1b000822e5274bd2cebe635dc9ada925551b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806053, "uuid": "71b973ca-db00-44d9-bfc3-26ee0a6f24e8", "value": "T12152FBACE0A746E88F86ABB8672B5F45018C762EF79991323678973457D1D3A4023C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806053, "uuid": "60590476-6fa4-4861-98bf-082f7795bb1a", "value": "192:CZbrNlIseUCHz4XMDBZOvxcbMfVs314en0gFxFP/nKoFnUOdu12rhMBR3Xa:EnjiUB5QMSmenTT1SoFUOs1wMBNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806053, "uuid": "8e856a91-79a9-4319-8125-10d4e6773497", "value": 13503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806053, "uuid": "c3547344-8caf-4359-9c5c-b895783a67c9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806053, "uuid": "de894e90-44cf-424f-8f10-492c15d8a916", "value": "647593.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66409d1-5672-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638781122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781122, "uuid": "9311e15e-e4d0-422d-94e9-30982a079618", "comment": "Malware payload (CryptBot)", "value": "e6e8b49853b5de540cb0bdcfbead96d2", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781122, "uuid": "eec64cea-b34c-4166-937d-0122724ae5aa", "comment": "Malware payload (CryptBot)", "value": "23715d03c0e0a17c873b6f3927b4f5d462fdae213e0694e15c0b9c9819b89173", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781122, "uuid": "de0b00e3-04a4-453b-a01a-7e71c2a74a76", "comment": "Malware payload (CryptBot)", "value": "c62a8aaf28b3417c1a5ff3ed41dae44773ba0b55", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781122, "uuid": "9edbab75-5048-41ab-8c2c-54c4a10fd11a", "comment": "Malware payload (CryptBot)", "value": "810993a1cbc39fcbf27150846a3712726a0352051e43b8ce355cb0c363070a3eb59ee8ed4df53e546573103eb64813a0", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781122, "uuid": "0230e89f-7cc3-4e16-acfb-3b1bce2c8a00", "value": "T17484CF1172D0D033D09265758825C7B68EAAB4751AA66ACFBFD85FBD0F243C2673630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781122, "uuid": "559d3fa6-6cac-479d-ae05-f2771d0039f3", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781122, "uuid": "eee5ead9-016f-4d91-bfc5-64c96dd96e47", "value": "6144:1/PqpmOuVrDfc3WVRbfK1rfaQ39oZXjVMPo:1/P4uVfcmVRLEtwXKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638781122, "uuid": "a14ff764-95dc-4fe1-9c7a-e28797f994a8", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638781122, "uuid": "10164f92-253f-462e-98a8-232a81759fcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781122, "uuid": "b4a80c7e-cfed-48bc-bc16-24021edaaf4e", "value": "SecuriteInfo.com.Variant.Mikey.132634.20300.17352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7e3fbe-5697-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638796861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796861, "uuid": "9537a8b0-095a-4681-953f-e15b3bc0ca68", "comment": "Malware payload (AgentTesla)", "value": "bda0dc302395503a169184a6d8660580", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796861, "uuid": "931b90b8-1c55-4545-a909-b21ca3791170", "comment": "Malware payload (AgentTesla)", "value": "2386fa2a2ba8386ace2ccfe78613463dfe25490013a9356657a2162bec00e44b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796861, "uuid": "bb3e267b-7ac3-4b2a-a53d-00ca3bbaa4f3", "comment": "Malware payload (AgentTesla)", "value": "ab85d58cb68459392c415cb148bccdf69fcdcb63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796861, "uuid": "49527c44-c63d-4a60-8df9-df6b3217f7a6", "comment": "Malware payload (AgentTesla)", "value": "bc5412cc487f48a7e0842c3bc0e3c53aa426f4da17ceb6e17d6fd1aedf8917bdb98ca8696778f603e161d0c8da27eea3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796861, "uuid": "56e20f44-c73f-440e-8716-d88bce5321d5", "value": "T1A8E41240B980F5A6C97848368D59B3794BB4FD2513E286473FB8576F2C012FAD23D7A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796861, "uuid": "63e2c817-af86-44c2-ac84-efededfeaba4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796861, "uuid": "84926fb6-a765-4935-8080-3d0f2a9134ec", "value": "12288:Cxd4JdL/KEj8OL+vtukmyA4OmPFebzRsPzcMnPVvJpE9Nwo8G2ii5:CxSbp8tuTmIzwcMJpE96oYii5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796861, "uuid": "8a5d9a3e-b785-4915-b8dc-b62e6ffba076", "value": 670502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796861, "uuid": "10cfdf46-2c6c-4e44-b49c-29f6d4d8aee7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796861, "uuid": "85bce9a6-d56a-4b56-832b-e187c4eb28a1", "value": "DHL STATEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2847bcfb-5635-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638754685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638754685, "uuid": "dec3c94c-2cac-4cd0-9e89-e9f251de9451", "comment": "Malware payload (RedLineStealer)", "value": "e2ef7fdd3c0245967e78b6324a0686ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638754685, "uuid": "2e4e4991-d6c7-44f6-b298-482e123f2ebd", "comment": "Malware payload (RedLineStealer)", "value": "23bfe7be5214636e3cbbd92b2b5e4271ad70b1bc6a4100d2fd7726ea2d34f151", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638754685, "uuid": "aa64e1fa-cae7-497c-af1f-342a16f2c3e9", "comment": "Malware payload (RedLineStealer)", "value": "a3ba7be1406f2e4681e5723233380b4f1e98bfeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638754685, "uuid": "be694b00-118e-4e04-9bb2-f1751dd04bad", "comment": "Malware payload (RedLineStealer)", "value": "e8286a6a0d2368487b0b324331b1a01b6bf5ce04d28912e738be611fe8fbcf2e4b8743084c33e8beb89fdb3bb98dd686", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638754685, "uuid": "ccfcccd2-0c5b-4ae1-8139-a5f663d1204a", "value": "T13275338E21EC3747DDFD433D1F39AE4A132EA1B99899A04EF4E04366496D0A3616C1FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638754685, "uuid": "e6e26586-b319-499c-a2e3-c1dd919d4b47", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638754685, "uuid": "3b49f406-5674-44c4-a4a9-c4b4f73b37d9", "value": "49152:KDSq6dzLkGQB/fK3uCKuEv9MC/73MRKgwNaCU6NVD:iJizLkGA/i+juEVj3AKphF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638754685, "uuid": "f6c956a0-a50d-405a-a8e5-45f935572ef3", "value": 1609448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638754685, "uuid": "76c87d75-1884-404e-829d-5fbf950470fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638754685, "uuid": "36796986-7b6a-48f5-806f-2b8e8e877612", "value": "e2ef7fdd3c0245967e78b6324a0686ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dce716-5690-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638793768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793768, "uuid": "a3d34c2b-35a6-47b2-bc08-a7eb0014c447", "comment": "Malware payload (AgentTesla)", "value": "6d5e37a899dd91d753996c1511d1f421", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793768, "uuid": "08f77abe-e3dc-447a-927d-1d73aa249a24", "comment": "Malware payload (AgentTesla)", "value": "2443e2bf86eb293ffd5bc7e71143d832abc5156e7433b15dee0e2508debec169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793768, "uuid": "87c1ff88-84c9-445c-a8b5-2a735aee0546", "comment": "Malware payload (AgentTesla)", "value": "0cf2dafcfcbe5dbf13fd2e50e9c9a77c35f2a094", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793768, "uuid": "e2e84fd0-dbfd-41b8-b3ad-fb850de64f6c", "comment": "Malware payload (AgentTesla)", "value": "c7f1bdc54da0d1d2af4d986682079092c4796b4d5a9402fd1bd689a7e0d1b480cb13121d75522a489f872eb6bb21e63e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793768, "uuid": "f4a15fa7-b6e5-4346-8b5e-3dfae7d2e341", "value": "T1C0557A2D22B4186BE87D1A351425473B4EF26C3D997BE3CD3748356B4BB36840A263ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793768, "uuid": "4ba12755-98a3-4b36-ba0b-7cf90f3f426d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793768, "uuid": "5ef5276d-6b73-4446-972b-46fdcdd48190", "value": "24576:YFNaTj+H5vC1RjrWKZYmzkE9SKsGL65gVsW5ZFYzAZou0wZ0L:QKL1SmzkySKs3WZ9Zou0wOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638793768, "uuid": "15a32731-2fcd-42aa-aebe-88d75e84ef46", "value": 1358848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638793768, "uuid": "c7bcd3de-b094-474f-9c38-5421a9d4c09e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793768, "uuid": "78b1260b-2f9c-46cf-9cf4-5935ed6e36ca", "value": "New Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994c1b6d-56cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638819728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819728, "uuid": "9afdb164-431b-4279-8f5e-e492a8797c22", "comment": "Malware payload (Dridex)", "value": "0e873ae39ec68fcab7c2e4ceead70cd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819728, "uuid": "aeddf5f4-9fb1-4517-a481-0083b2212cf5", "comment": "Malware payload (Dridex)", "value": "24cf97c3e98d3fb31ee8f331bc6b990205967ca68679494ab3688c8333cb6773", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819728, "uuid": "89c987be-fb13-406f-a4cb-b4535baa7f50", "comment": "Malware payload (Dridex)", "value": "2f0d17e38a45a74bc876f6e2f2f1ac6fbe7323f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819728, "uuid": "7b4ff712-b257-410d-a0cb-6df09461ff54", "comment": "Malware payload (Dridex)", "value": "087f8ca354d5b89591a4c68914da7855d0c0b64acfc1c74560dfbd00e1d7d87f5c2d23f21a910c71f6d272ba96628f2c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819728, "uuid": "73e3d03d-f27b-4c84-b7d7-dd7d749cda71", "value": "T1D5D312D5D0442E03E39B3CBAAD2D0D75F2E505008025CBA934967A5D8DEA36B1E6DB1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819728, "uuid": "e04c67c8-1d90-4387-b695-81299a43676e", "value": "3072:twS4PD1Mn0EZ2EuJZDlcAmEFn4RCmWGYw1Vk5zCpRDCBdaZ:34rM0EQPveAmqnjC1Qo18d+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638819728, "uuid": "3797bc08-65a8-49a6-a41e-e7afa2bb052f", "value": 140061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638819728, "uuid": "4d857d36-5318-415c-b88e-3a343d6c05b2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819728, "uuid": "4a2ade16-3f12-4b79-9e1b-e00bc094148b", "value": "Payment_852111282743.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f039662-5684-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638788814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788814, "uuid": "72bb0a9a-303c-4c8d-b827-e4e2b37559e9", "comment": "Malware payload (RedLineStealer)", "value": "23642a5e8e482d0477e9ec2ff4d512aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788814, "uuid": "652e0b21-3b21-4f91-ae4c-8458c7f72c15", "comment": "Malware payload (RedLineStealer)", "value": "25015240858f6bcb6bf902d9295ac0fb95f097b17a6079ced8d3efb3c345dac5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788814, "uuid": "26529750-eea4-4693-b07f-427dedc0a53a", "comment": "Malware payload (RedLineStealer)", "value": "809282c5cbb3fef05c102c8843b078a0cadb6f29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788814, "uuid": "987dd5ed-a39d-4ec6-972e-69498f04e2c0", "comment": "Malware payload (RedLineStealer)", "value": "50f87d34312040f1b504b4f0e57e8a068a731ae6ac8f50a8f9fa425bf06eab1dddf666b6093f7a94f4dc976aaf103851", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788814, "uuid": "a64ef72f-0e20-4f12-9828-9e7541f809b6", "value": "T1F5549D2133D0D032D49329768525CBB58E7AB4716A666ACBFBC41FBC9F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788814, "uuid": "8efc0255-47bc-4860-82a8-f4f37125f30d", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788814, "uuid": "e28b5f75-12d6-43d3-8db8-f9cd6ae322a3", "value": "3072:vQ1N5wKaRXhZZMBmg4dNp2q3HJivNgTgpT6ulvt4O+K0DAT8fQCSqeETTB9cX5Pu:evw1RXBM6p/3wppTtvtfx8fjbTB2AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638788814, "uuid": "62810d1b-561f-4bf3-ba90-e936b3fbba6c", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638788814, "uuid": "9ec2a636-0096-4981-a1b9-25d1ece6f442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788814, "uuid": "bc1168e1-5954-4a42-9b5a-a877c46b346c", "value": "23642a5e8e482d0477e9ec2ff4d512aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856e8d75-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638760424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760424, "uuid": "feae120e-a588-4766-b340-895e659695f8", "comment": "Malware payload (RaccoonStealer)", "value": "b01eb876b50bb103ecd0131707672fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760424, "uuid": "98ed8b2a-65f3-48f0-969b-a2413e9a1384", "comment": "Malware payload (RaccoonStealer)", "value": "25128763bec88f9e6b4a99d05f4aa46fd3694452851fda8b1b5cbc0eb0474fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760424, "uuid": "ee30ef26-2b56-4773-9ca8-3ab6e463bdcf", "comment": "Malware payload (RaccoonStealer)", "value": "3886e5aef519a9a8526dcfd2487393c4f32cc077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760424, "uuid": "3e838dab-56db-4a5d-bc69-1a883254779c", "comment": "Malware payload (RaccoonStealer)", "value": "8467645afe7552ea49dfea58e6865710050359d65afc85383b3c4b1ddf5c8c526e13ff42c10f64ea61a5bae970a62313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760424, "uuid": "c08f167c-eb23-4133-a827-82b7156f674a", "value": "T152C4F11232D0C072D0A621B58525C7B55A7EB87507369BCF7BC506BD1F287E1AF3A32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760424, "uuid": "2911e7d7-f2f2-4811-8283-ad8ac821a52f", "value": "1b81e8f7d77881f7dbd36488c7ba26dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760424, "uuid": "7c3cbcf5-03ad-4ce3-b3c1-0e0f10d7085f", "value": "6144:L0ilB0piZGzYDI6vv13qdu+NwqnsmmWNNbRihtUgM89vcu6zhFzAyE4Npjs7C33i:L0YZZG01CtBnsmmWCI890xJrE4Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760424, "uuid": "928fcc2b-6848-40da-a82c-cbfa27f9494b", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760424, "uuid": "322d819d-6549-49bd-9974-43045205a212", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760424, "uuid": "66fd1271-fea4-4d40-a7ec-9dfb0f82e8b6", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.31726.5500.5044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b787e7e9-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638812048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812048, "uuid": "42a1b000-84e1-4cb1-80db-d62a7a2ead5c", "comment": "Malware payload (RedLineStealer)", "value": "af9d77b8a702451a6eacdd7e32ff6eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812048, "uuid": "e1ee7037-df27-41cd-a191-f9e4bc5daae5", "comment": "Malware payload (RedLineStealer)", "value": "25392b7aecc8a6ad2d0b4cd546115eeeaa9069c60f9002001df83c9de78350d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812048, "uuid": "a790e02b-638f-4110-9112-36d71f98faf8", "comment": "Malware payload (RedLineStealer)", "value": "1199227c5467a590006c97dd590bd81989a9b57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812048, "uuid": "e031b354-2da9-4868-9505-5ae6f34f6b60", "comment": "Malware payload (RedLineStealer)", "value": "20b4af4bdfca033dd0d29d986c7dc6a6d33aa6b9d13e303c090ca1ce77cb5a618a5f2de11ac3c4d969ef1e1b5c7f244f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812048, "uuid": "9f723aed-aa9d-4781-ac30-f14468772b8a", "value": "T1CFC407097B908A8CDC33F5B1B8C7EAB71A9E1ED07498D3115817B3E32FD1524219F9A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812048, "uuid": "320e37a7-8217-41f5-aec0-42f12242ee0d", "value": "5790158e8cbc72da384f49c3c6118b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812048, "uuid": "47673bae-41e4-4135-91b9-83d70b078156", "value": "12288:GJOdJlsksS8RWwZhA+2QW6ll3MR61lcQJmi3yJw:ldJlnoWbm9cQJ5iJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812048, "uuid": "20b8427a-3df8-48cb-8a8e-415d38ca56ec", "value": 567744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812048, "uuid": "f599b3e9-fe0b-4ecd-bb3a-9e83b76a76bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812048, "uuid": "0e3ef94b-f1f6-456d-bf15-f7f6322fbc79", "value": "af9d77b8a702451a6eacdd7e32ff6eba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1a9e57-56ac-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638805914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805914, "uuid": "da7f5a97-1aba-48b6-8d8c-36ed19113c30", "comment": "Malware payload", "value": "03c12da9deb93149b17c29c6ac831199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805914, "uuid": "652a0d81-4790-4aba-9060-225488cda632", "comment": "Malware payload", "value": "2557132b9f77c5f322049fa9291ccfaffb235de53432c09f03d1393294b8e68b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805914, "uuid": "c764e07f-ab9d-41f9-a84d-3471a25df370", "comment": "Malware payload", "value": "409673d6901ba284dd985195df34e1728b37a88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805914, "uuid": "5c7cf303-581e-42d2-b2fa-6eb1beb3839c", "comment": "Malware payload", "value": "8950b56b404a3b0ebec056b987edb4cbdb6f37f5bb4e6da89a582fa8c2aaafcae814c2d19f3b8f4e9bae9d06d8573ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805914, "uuid": "978c3a24-a21f-4e6a-83ff-fa5e20f5f725", "value": "T182136D257AC0C072C152B8B25A2DE7729F7D45722769EAC7B7D69A311F301C0A53E24F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805914, "uuid": "98707d65-3951-42ab-a96b-97d5df9a1585", "value": "768:MP7EZ27x8NDJQk8sTrlXK37FU5ZojStTPc3+sv7Ja860OmL8tHfpHMK:MlZkfTZXK37FUrQla86ZtxsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638805914, "uuid": "2b301c96-a227-4943-98f8-a7736d3c4fc1", "value": 44872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638805914, "uuid": "dd16c58d-5400-4aed-aa6f-2f77f591e353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805914, "uuid": "cfe9b6f8-0840-40bc-93f7-a0ed1f3ce2a2", "value": "03c12da9deb93149b17c29c6ac831199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0664fd9d-569c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638798866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798866, "uuid": "3d633ed9-66ce-443d-9a0a-6a286822f4c6", "comment": "Malware payload (AgentTesla)", "value": "3ee0362b007c0976709569cfa9d210de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798866, "uuid": "918c409f-c4fa-4665-a0f3-f04747ada766", "comment": "Malware payload (AgentTesla)", "value": "25ef976944a8f017d6504a34331174da6d4188e4822c5dc7847b131435537654", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798866, "uuid": "a446f6c6-f7f7-4039-807c-580388a3d2f6", "comment": "Malware payload (AgentTesla)", "value": "c2c2905c5cf96710e95453e32d181a5557d0e035", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798866, "uuid": "970caf2c-f640-4252-8cd5-0579c82a0dd7", "comment": "Malware payload (AgentTesla)", "value": "7d9fbb7711278f4b1b253a255b33c8ba0173d4bc06de6010284910ee2fdcc90f94eec1082e72497599dfaf0d98e26eb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798866, "uuid": "9cf650fd-b76c-46a9-9429-3a9a60ca43b8", "value": "T1BFD41242764CD817C6A91AFE459FF1F897B835C83D4B821A7FD07DAF7C52583980228A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798866, "uuid": "1bf44eae-64f0-4b52-92eb-21f8b263ff3a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798866, "uuid": "01a2cbf4-ba81-4f28-b6a3-b45d49f2d63a", "value": "12288:MP3wPGE+XaoodHmzdhg+BClmA0jzUBNVVnfXl5ViSB9mTE:SKGE+9ohmzPgPlmA8zQffV5VT9mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638798866, "uuid": "2b4053a4-6b86-4dca-9f49-98f73ab20fda", "value": 649784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638798866, "uuid": "410717f6-7c98-4d84-95e0-8bfb80036272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798866, "uuid": "2b650726-97fd-49e2-a843-6be5d33b46fd", "value": "UI CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4c4c94-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638789724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789724, "uuid": "c019a767-8251-42e2-ad8f-9e88b321b01f", "comment": "Malware payload (Formbook)", "value": "a3397063c187f1d895e3603c5af6a078", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789724, "uuid": "0cb6866c-062a-4415-a9ae-c15ffa13906d", "comment": "Malware payload (Formbook)", "value": "26a72c093b24e198f0de33e9d5d599ee74655b97f00ee102c3659ebb0ff7d43c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789724, "uuid": "6dfb579f-38fa-4a22-8a36-ecd860c968c1", "comment": "Malware payload (Formbook)", "value": "f1dcec96a9bbee9189f0c7d8f57dd2863373033f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789724, "uuid": "0fbca770-0e4d-41c1-927f-2ca9acd3aa41", "comment": "Malware payload (Formbook)", "value": "13790504ba07077205e7c5fb8826d34d62a317e963828d0375af4b7401ae75b82b14c9d7652fed2420fd1ef6fbba41ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789724, "uuid": "f9f59946-3eb2-46e0-add3-1b2865010b63", "value": "T11734124C3CB0A378CF9D077E5E7FA05C42EDDED269E8A6970C747788893E9207816919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789724, "uuid": "ac57a54b-a80f-4cd0-b71e-b261a64fd51a", "value": "3072:XZLV6Wn+CFCNO/X1/6YPLId+9QMl3Jm0LYXZnqZxGQF7MnEmofsdCnTn9zzTY2ul:RwCFXPsYzIMllZmmxH4ofsMTnhXYXGv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789724, "uuid": "505821be-209e-4fb8-9481-5ac727b7f828", "value": 234392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789724, "uuid": "b547eaea-8ac0-41b5-8e24-dee2524f5fe2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789724, "uuid": "c4fd4ac8-ec4c-411e-aee0-e5763051992b", "value": "Bidamedipharms Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc4755d-564f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638766183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638766183, "uuid": "7ee0cd0d-8145-4a65-93c3-828f27dff6da", "comment": "Malware payload (AgentTesla)", "value": "76a5ec5064a96887cf870ca8e363ffb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638766183, "uuid": "136a272e-5911-4c94-aeb6-2156c550b80a", "comment": "Malware payload (AgentTesla)", "value": "274095617cb8864b0d6729684ba069da9e2a2d3bfba8a265fdb10d59d91a9d66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638766183, "uuid": "9d63a920-1741-47be-b6e7-80421e1da7d6", "comment": "Malware payload (AgentTesla)", "value": "9308dd41877d1c230fa1d9b2de660ff309886323", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638766183, "uuid": "efd7aeea-1976-42e4-80ce-b041080165b7", "comment": "Malware payload (AgentTesla)", "value": "d9a8bf6b1e590cad268d4c9a970c71610021a07d0e22af5e90cb9ef167babc3f815f7a5f41b06330699ebd8bbc614e0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638766183, "uuid": "20036a59-8faf-4968-a624-93f5b6f84ea2", "value": "T1E135125B28AA420EF6616D755FBCF172C15EEAF119761CB75DF7090A0012AF08B2DB23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638766183, "uuid": "a98fd9e8-16be-4bd3-81a2-b8df9c9cc0fd", "value": "12288:XOSw+1s+nKyNUwBIIep7KXfhk7tnYYwP:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638766183, "uuid": "08280a4a-d88a-4008-86b6-4dea8937d440", "value": 1140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638766183, "uuid": "c60820d8-6e09-426a-8c1b-bc1100caace1", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638766183, "uuid": "01de9a82-37c2-4233-96d9-7844a028ce78", "value": "Swift copy.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56942050-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638765070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765070, "uuid": "9eff5c8b-5b6d-44b5-b59c-817bc0eda4fe", "comment": "Malware payload (RedLineStealer)", "value": "41b1a13f8ddd162a81f25afd32aeba7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765070, "uuid": "d72466df-6b89-4eb6-bdd5-f1d21ee822c7", "comment": "Malware payload (RedLineStealer)", "value": "27aded444c6a670fa445bf35361b84be2d509f418afa47361a50808a690b5908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765070, "uuid": "793ba5db-abc7-41e4-b32c-eb8132f5f5dd", "comment": "Malware payload (RedLineStealer)", "value": "a777c1f3c1883050998f05797048968fe8d4e306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765070, "uuid": "792ada3d-9b5e-4965-b4d5-092d203c46f1", "comment": "Malware payload (RedLineStealer)", "value": "f17287e8f59440f335e8be5643483533d076e51423204731b66b8cda97a135285af2a30b5c44a923e0781c73e6772a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765070, "uuid": "8fa3c80c-4d75-4400-9646-3f2568114b68", "value": "T13154F161B3E68436D5A21230983487A1967F7C327A31819F77F42B3E5EB06E0DE69347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765070, "uuid": "1874f6f2-f7c4-49e5-b8eb-dd0e1ec54b07", "value": "2aad955a2b43c6309ea940b357fc162c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765070, "uuid": "55a14bd1-6c5d-4b76-a95a-70be728b6ca6", "value": "6144:O2pj/jejprlBaKHJy39ASc4QzL54cNx0dyB49DF0:O6j/je5loKpy391cfBNid0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765070, "uuid": "76b6411c-fa40-4f42-9e31-2920cf7c76b1", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765070, "uuid": "133a9104-7197-4d32-b1a7-758e6008fe8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765070, "uuid": "2c5ca583-c6d8-4fa1-b65a-e99958d87309", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.7532.25099.21956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29859971-56bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1638812239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812239, "uuid": "28b8d8e8-22fc-47d9-85ce-70165fcc72ca", "comment": "Malware payload (QuasarRAT)", "value": "3a4691ac3498376d0a19dec156719354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812239, "uuid": "62a0b1ae-5a62-4bc2-b7d1-6e60c31b222b", "comment": "Malware payload (QuasarRAT)", "value": "27b3a6622606e48e952bc421ace976c09cbc869c30a93f1526cecde36eff5ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812239, "uuid": "1645aac1-4018-4e36-a151-b8d8ab4ddde9", "comment": "Malware payload (QuasarRAT)", "value": "b89974cbf365ccb256a5f7bc5adf6c6438799400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812239, "uuid": "955fbaca-bf74-4536-9ac9-f83e3bd828ef", "comment": "Malware payload (QuasarRAT)", "value": "5e25af23b7d52a354828d611905d1ee49aea550c97b73cb88240920fd43aca60300d49fedb08749da78ea10967b398fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812239, "uuid": "d2256cb5-5636-4b50-a7fc-b96e3faf779e", "value": "T1B7D5E1DAA484CCB1CA9B9E32A1374EDD7327CD56412ED51D23701398C98FA516C0EAEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812239, "uuid": "935ab501-422b-42dd-abc1-f6a9fa91d4b1", "value": "3856479c39e05328ad3d8b43b994937d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812239, "uuid": "0f163fcd-c94c-4073-8780-2b51dfcb9399", "value": "49152:chn5lwIGn2t7HILxcHAazObUOvHK6eqULJ1gZ3UB6IebU1:chDHG2tfgEWUOvKLJzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812239, "uuid": "79633536-b8f0-4c6c-b4d4-91e440f95e3d", "value": 3011072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812239, "uuid": "b34fce66-056c-40ae-a21b-102746f6b18a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812239, "uuid": "dc9dec68-e8b0-47e1-8d7c-513357a17499", "value": "3a4691ac3498376d0a19dec156719354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011aeff7-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778241, "uuid": "7ffaf4a4-1357-4ad1-8bf9-847a74768ffd", "comment": "Malware payload (Mirai)", "value": "6e2d84ddadbc909596435133920e88f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778241, "uuid": "d293bbbf-03b4-4feb-a21b-beb7eae38690", "comment": "Malware payload (Mirai)", "value": "2812f43205d9a34abd1ca515761eef269f1b9c43b558fb8cef10f119d7ed01f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778241, "uuid": "e7e0fbe2-c4b1-4c62-8ceb-53aaed6d0440", "comment": "Malware payload (Mirai)", "value": "ea1f535e893ac018ff08a004f64cb307337a6cb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778241, "uuid": "24506ba8-d30a-4f71-851e-466c19cf6653", "comment": "Malware payload (Mirai)", "value": "ce5e4a4b1324507f752794a13b1d3c8441cc840ffe7bdb0d49185e8849677575b1ba0b4a9623fe67a1bfd16d001f3673", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778241, "uuid": "6882e302-2704-48c2-a75e-f503d3489101", "value": "T13533022D05B5CAD0B0704CB3C57AC21570A0762891CFF101D59F5BAE79B430E69FEAA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778241, "uuid": "ccdf6e8d-d459-4d15-9dff-2cbab530f22c", "value": "1536:W9zjue7ihj+fCxfWD/SzpJfkX4wuMWRmOzE:W9zjuYiI4DfCrOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778241, "uuid": "deec2790-fe5c-4e17-96cf-9cd2a06fc8bb", "value": 50408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778241, "uuid": "9953b99f-52db-417b-8d51-0cc8a047d7ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778241, "uuid": "b5e7a37e-085f-4e46-bcb4-85b4a63a4c8e", "value": "6e2d84ddadbc909596435133920e88f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1759a1f-567a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638784523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784523, "uuid": "306b9033-c161-4959-b52e-f8fe842062b5", "comment": "Malware payload (Loki)", "value": "6a69a776cfbc1a47a3aa82e2ff209cb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784523, "uuid": "ce8d47c3-6b0d-4f79-8d0e-2735b2a03bf0", "comment": "Malware payload (Loki)", "value": "2925d712056ad8d988f801530de85a74e9ee152e14269b0946ff8a067e8ef419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784523, "uuid": "9a975268-ec82-40f2-8976-8ff21fda6e31", "comment": "Malware payload (Loki)", "value": "b508dbc1ac8539f3ac5946ba36c62f928dd6d13c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784523, "uuid": "39b5738f-0b00-4188-b8b2-c78a440216ce", "comment": "Malware payload (Loki)", "value": "8f32fb49b8875a9df2e55299069ee0c81601aa5173245a8fc0f1c75ff8d985d31779cee9e5423d6f6addb767cb4a3b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784523, "uuid": "8daab46f-000e-4a7f-9257-0643acb92fae", "value": "T12874238995D1883FCB59A53E30373E5EE3B642E862E6568F43408E376A771C749212F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784523, "uuid": "d1444d72-f509-4480-8087-b631319ab28f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784523, "uuid": "c37acb3e-b520-4f01-85ac-1db7c4228d96", "value": "6144:rGiqRk2EJfH3eqDG+ORo1mGAtrvEuoUIDQJMLY5EHAhG2bpH6sivE8+wlb4XTFzs:uJXogGAZUVE+kqHAhGGl6vszeSELoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638784523, "uuid": "21248473-c26e-4d4b-b06c-fae10be2a704", "value": 355810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638784523, "uuid": "6b832262-c144-438b-afeb-83517231733f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784523, "uuid": "832637e8-fdf3-4bfd-9cd7-3ba13565251c", "value": "Invoice Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edab65fe-56a9-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638804837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804837, "uuid": "0c691364-eed0-43bc-8f4a-406f41568355", "comment": "Malware payload (AgentTesla)", "value": "a9208fedee8478514d5183f81e03ae7d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804837, "uuid": "4dbc1686-cf15-4b91-872b-0cf178d752aa", "comment": "Malware payload (AgentTesla)", "value": "2962b443a4d7e584e59e0b52094c4e25fa76b664ddf2525fd8ec4c281d101db5", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804837, "uuid": "6ebbe41d-b40b-4d57-ac37-a43e963135bb", "comment": "Malware payload (AgentTesla)", "value": "657b1a9dae391edc2e3dc4cbedbfc429cda260d1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804837, "uuid": "312ffe2a-812e-4281-a36c-195b692ffc69", "comment": "Malware payload (AgentTesla)", "value": "769fc895bc2286ff3703d3d21ed1f43f872d9cb88d9504d28fa30cc90ae49c1ba5befc3c2f55e8984a84acbb25102492", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804837, "uuid": "c85f2814-bc57-4090-ba0e-9b3c496c4dbb", "value": "T12E45331177AB168C3F1A80C640B09E767F0882503E7AAB6378718D389DDA59F7C5F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804837, "uuid": "417118de-6b99-46d6-b95b-701c645ed5db", "value": "24576:EBGrof1VHwXlogAdbDP1wOp29f8EbQdDVvh9PPo5xXV4Yv:EBEo9VHwogAl1CfnsFVLCxl4Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638804837, "uuid": "5d4dc5d5-c9e0-4b34-a43e-eba05accb8f3", "value": 1185984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638804837, "uuid": "8c8d47d0-24a2-434d-9cd7-600b6d30eea3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804837, "uuid": "e3af1e51-623b-4bf0-94f2-e991a2ff37cd", "value": "Payment Copy.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f0c365-5674-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638781986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781986, "uuid": "6aa4f2b5-c046-498d-98a3-e3f57d5206ae", "comment": "Malware payload (AgentTesla)", "value": "a4df919c700161af9d44988243b68a3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781986, "uuid": "c7e15fec-38c8-4fe6-b629-0213eec64eab", "comment": "Malware payload (AgentTesla)", "value": "2a2e1dffdee554d9756e662e98d472f9fc0c9b842867b11600b3bd49b787686a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781986, "uuid": "41b1be3f-14cd-407b-badd-4c0cd302aa8d", "comment": "Malware payload (AgentTesla)", "value": "6d4f102ad926ffa4c07f904cfabfb0badfac1123", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781986, "uuid": "02473db7-203e-460e-9712-994f0ceea86e", "comment": "Malware payload (AgentTesla)", "value": "12dee69a971cc3bb0baf7122eccbc423809306a3e493cc1f2d7fb5ac657c958879425570acd1382d23001062d6e63167", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781986, "uuid": "a7ec836a-09b2-41e3-916c-0c0b63092102", "value": "T171656A5C313025AFE83A853049541F7B9EF12C7D866B53CE721731AF8ABE5468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781986, "uuid": "5f9498c1-2296-4473-bddb-24828302e9c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781986, "uuid": "e764acd5-c119-4eea-b1ee-a2481819a0e1", "value": "24576:kaAoSLwdipTDFn7viIGMQwoVxlxsH5h73+OalDRqOWqDaTzrcZBDVwMgM:juLwYpTDJ7qh77xc+OaJR/WbzGB1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638781986, "uuid": "a0d96b6f-6e87-482e-9fb2-8b1dcb0d8b83", "value": 1431040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638781986, "uuid": "b32e8c87-5626-44ac-b435-52352efb0fda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781986, "uuid": "66346df7-886d-422b-a21a-bb861c7ef79e", "value": "Ordine RFQ-PR80-90502-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc17d9e4-56d3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638822820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638822820, "uuid": "bd42ee46-f630-4b06-bbb9-46833ff80c3d", "comment": "Malware payload (Dridex)", "value": "923db97bea22784bdddeed9fcd41ae11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638822820, "uuid": "48e19d7b-61fc-47ed-85f4-f2e6912773e2", "comment": "Malware payload (Dridex)", "value": "2a7fadfd79294f9046067dafdef3e9eeb38a3e46461749c1f12d11d7c84f60d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638822820, "uuid": "45764088-ba26-4b11-bfde-a3297aba7a86", "comment": "Malware payload (Dridex)", "value": "21711688a78dd659029ef20ff169e2304163ee36", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638822820, "uuid": "41e5c8f1-4250-4868-93db-51ed265ed7fc", "comment": "Malware payload (Dridex)", "value": "28f15ff9044aca8740f9e64f976a921777428e2de640e9844b9b3a69fc64297a7d983b3614a3495e92b4c844a2eb5686", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638822820, "uuid": "39c180a7-c642-4c64-9918-963c71053f4d", "value": "T1ACB3E1CEA12AA005D45A187BD4EF38F937B80F513C825F15A092EB599BB12FFD5462CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638822820, "uuid": "f81edbe0-b0f9-4283-a60a-d56a6666038f", "value": "3072:AGqSJypN2GvlCK51M3oe6iv5A0qDp6p5ux6RuZen0d2O0k:9qSApN2acRU0gp6qIoe0d2OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638822820, "uuid": "64a8a623-1ceb-43c4-a7d2-6b5a29fe6d24", "value": 108619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638822820, "uuid": "e1d8917f-16e3-4ee3-baab-aa97212463bc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638822820, "uuid": "d70b33cc-6388-45e7-b924-f1a1d0d0f000", "value": "20211206_133635_2a7fadfd79294f9046067dafdef3e9eeb38a3e46461749c1f12d11d7c84f60d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4804c88-56c8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638818163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818163, "uuid": "4d2b174d-09ff-4df4-a0b9-38c198307493", "comment": "Malware payload (Dridex)", "value": "e198f00f1a647ac1ba433e9fef9cbb85", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818163, "uuid": "2e26c99b-81be-4990-ba15-00f9b7a86b88", "comment": "Malware payload (Dridex)", "value": "2ad46c8101074fdec26510185eeee98fa0253c06fa87b54b5c15018d6a50970f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818163, "uuid": "73dc9bb2-a37a-44b3-bcd5-8744d312c16a", "comment": "Malware payload (Dridex)", "value": "b15fa3972a21acbc3118a8243a965b4f0eaed4e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818163, "uuid": "1eac0451-a407-4ad7-b5dd-d60cb0c2c9a6", "comment": "Malware payload (Dridex)", "value": "bf897b46a2ba4fa4545e4d28de6f15dbfd19b9bac6777596a1f5fdcc195504db77776007f8ab290d2eb1ec422a486942", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818163, "uuid": "9e2f2047-c37e-4b58-81df-5f276eae46ce", "value": "T15DB3026EE246F010D17F4CBA826F78798423B8A3DA40F1277856E64C0746A25DF1EB6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818163, "uuid": "557ea08a-9548-4f82-ad19-bceb3b46292b", "value": "3072:htvg571td/fKxSKREvpER3yPpIMoMG64zp28cdeY:ht451CQBI3TMoMuF2hdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638818163, "uuid": "763d0362-22e8-4c20-a0e6-6b7232f49aa4", "value": 108104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638818163, "uuid": "279388e2-83ff-477a-b311-6465a96794bb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818163, "uuid": "cd06fd4b-9ba0-4d38-a3a3-1fb42ebacb48", "value": "Act changes80887573.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5999a6-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1638775549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775549, "uuid": "25c46c37-988f-40ea-baf7-849c20473265", "comment": "Malware payload (Socelars)", "value": "3b4b7db4dc9d5f5edc77c5ad5718ac27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775549, "uuid": "3cc7d792-f90b-4680-b913-1b71f667a0fb", "comment": "Malware payload (Socelars)", "value": "2b2f95d5593c9d37f482124807c5024ff27ee1944bf8940b777212f77f871895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775549, "uuid": "b747425b-32b8-48fb-92cd-6f666b5dfe05", "comment": "Malware payload (Socelars)", "value": "8900bf8be78338e7a4398fe7124d6fea08d7b06c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775549, "uuid": "ba6f1fae-01de-4299-8823-718d4d4176f6", "comment": "Malware payload (Socelars)", "value": "fb0e6db009035231f621ecb4f4d92ea0ec1cd5770997495cfb142f91d905f3f46766300696b277f7380d570f7a05f3ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775549, "uuid": "c8e6a81f-2b30-424d-98e5-e0ec4da36bb9", "value": "T17465AE11F742A036ECE300B385FF56FE9D28B621030854D7E3C459696EA19E27B3766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775549, "uuid": "3d5f8218-c3f9-4854-8128-a453495c2d05", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775549, "uuid": "16f9bf80-9c06-4087-bb61-8a684a99b91b", "value": "24576:EEpfLmZkUtN/Wy+jtYkQkbF7vZjUodG/9QDE2hz0XCUVJAhwb0GXw:9pylrKY2D4+R50XCUVJS+Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775549, "uuid": "6ec2fd70-588c-44d4-8b65-04e523acd1aa", "value": 1489408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775549, "uuid": "4c7f85c3-6d21-4ea3-8062-d8e370e5a4ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775549, "uuid": "bc4fee64-e2ad-4f1d-a660-657fe71bf629", "value": "3b4b7db4dc9d5f5edc77c5ad5718ac27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830b4cbf-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638760420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760420, "uuid": "92df5d99-e98b-47c5-baca-ffb70b372bb4", "comment": "Malware payload", "value": "18f12f70ad6055e4eff0dafb5646f87a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760420, "uuid": "fc06b614-d5e7-443a-9c73-d67fb6e0b444", "comment": "Malware payload", "value": "2b636e7a274493837e96311e4ef1efe626359ecbaafcb0bd5414c4c3fe7ac4bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760420, "uuid": "dcf17308-8eef-4590-bea0-13924bfbe004", "comment": "Malware payload", "value": "d1d4772c5d5490913d7fd632c844ab89b84e94d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760420, "uuid": "4b4f53c5-d818-406a-ae62-e08498e27b2e", "comment": "Malware payload", "value": "5d1927f6497c676317608f75f21a2e72b41a5c06823b65a7c11c6d6e40b23d029cf7fd8551b03fa636636716fc4a5f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760420, "uuid": "3147a3b0-dc76-4ae0-9096-eb0758b97880", "value": "T1E02612693A10E9DFC69288F469E57E38DA707DA60E2F4203E55339BE9D3DB4DAF00051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760420, "uuid": "8631718b-8ba4-4ddf-8a81-701ea54bab64", "value": "98304:YJufOivG6QQXrAjg0nHcXZPFoZ4oHxLeQt/XCCUM9ktnB7SpvA3377k:YkfOivG6QQbAjcb44oHx3tx9kdB7Spvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760420, "uuid": "8efece8c-0e58-4bde-8fb7-2dcc30e45857", "value": 4678656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760420, "uuid": "a229c6f5-6652-474f-b38b-cce8125d1b08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760420, "uuid": "b3dafcf0-13b6-4cb6-ae9b-dc9c72be1ae3", "value": "SecuriteInfo.com.Trojan.GenericKD.47547246.21693.22684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02914f8d-5697-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638796712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796712, "uuid": "d8d59219-c4d0-4a31-8b58-2e9d824d42be", "comment": "Malware payload (GuLoader)", "value": "3b6f24e9763e32e2a14280d8fddcf94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796712, "uuid": "407dc7bb-7db0-41d7-9f68-e39e995b1558", "comment": "Malware payload (GuLoader)", "value": "2bc80246bbf0138938e3600a48504424d8910627919fedcd1649004dfaf4d9de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796712, "uuid": "b56a822e-4da6-415c-b0ca-6f225fc71242", "comment": "Malware payload (GuLoader)", "value": "a5080f5a99c7508e5220fd70c45797a83b33f7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796712, "uuid": "f2bdaaee-65f3-4394-b55c-4115d04c6945", "comment": "Malware payload (GuLoader)", "value": "8c7cc63af3bf4157829d12fdeaed9fb2e582f51584935d19464d2cd1f8ae0ed139a5a4d937f91308fbaedf088ac20afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796712, "uuid": "f646cf6b-9b57-4018-b654-74feed3b4201", "value": "T1E6E34A60A690E2DAD366B7B2EF2AF66C11146D33390108C75DC73B5C26B6B8395D331B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796712, "uuid": "138bc219-fcd4-4e31-afea-e2ae4a34be04", "value": "460340e2ce791b610d6d419830ceb88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796712, "uuid": "6c68009d-46a7-4820-8d37-628314810a1c", "value": "1536:4/qzSdiDYwfoiykw4/LWuCxthO3gtx9dLCHzFpEnPst:NzS0Dz2H4TdCxthsgL9dwBea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796712, "uuid": "7c7dd5fb-f03c-4e3b-a30f-2d4fac8918dd", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796712, "uuid": "130bb31e-fbc9-425e-8377-6dee4a174351", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796712, "uuid": "75d5b117-b6b7-461f-af6c-e34664c9c50a", "value": "summetonerne.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37164747-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638776184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776184, "uuid": "263bf70c-c952-48db-ba21-1c5e260989d7", "comment": "Malware payload (Formbook)", "value": "849f7122600073083d2f2f6966539045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776184, "uuid": "da33e00c-a02d-4dbf-af65-286de62b7a58", "comment": "Malware payload (Formbook)", "value": "2d3cbd6a4ee95a6940e508f1d1570e25201e1fecfa966c406bfde4525a82e74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776184, "uuid": "0d266c96-6163-453a-af82-c6a933ff47fb", "comment": "Malware payload (Formbook)", "value": "cffe2b10ce2565cf516b5ba0c4f2622e1e22b9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776184, "uuid": "1317f314-251a-497e-8ce0-da954a869043", "comment": "Malware payload (Formbook)", "value": "eb1b23daaf1e9c46694f93db056505ffbb130c405c3faa3997a9e19013a7a06e174113609e90a1e83ac4765f3b5e9d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776184, "uuid": "13262b48-2e5d-411b-ba63-2a75fda7e6be", "value": "T18264124AE7C154FBD5E745722A7AFBF8FBF901D10CA14E8767404EA62CFE4420D1A286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776184, "uuid": "10dd656b-b621-4c6c-87fd-652c12def60d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776184, "uuid": "85049fe8-08a8-47e4-8190-02150bfc8645", "value": "6144:rGiDy327c5Q76IMVPPHb9tD86pHksfbEyF/UnKKPCvYgC0:Hg1rxnHbbT1fXGP3gC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776184, "uuid": "96bb41d5-c8e7-42df-9b47-5a947c54d94e", "value": 319082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776184, "uuid": "aa8a41e0-daf2-45ab-8d90-791403e76c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776184, "uuid": "23a3785c-f456-421c-a480-d5eee513675c", "value": "849f7122600073083d2f2f6966539045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6dd5f7-56a5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638802899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802899, "uuid": "bd52e448-1d4e-469b-b4eb-9a29bc2bf4c8", "comment": "Malware payload (RedLineStealer)", "value": "5eaf686ef6e011e01baafec6fb976acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802899, "uuid": "93f218d8-ca16-44cc-8796-a3083caa7b16", "comment": "Malware payload (RedLineStealer)", "value": "2e3e6c8fbb8514dbac39db13045006ccc30a9e82fc69a65f56d5902df70ff055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802899, "uuid": "2e49c442-57b8-4276-ab77-7ee0d27c79c5", "comment": "Malware payload (RedLineStealer)", "value": "70dec1106c8b3e30b9f4c5111a5027514f78042a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802899, "uuid": "29e91653-7911-45f7-ab41-1fd44f45d4e1", "comment": "Malware payload (RedLineStealer)", "value": "7f1c3cbc4d1e87b2667a9d594fc668c03c524be3686a04a675d8126036364d2694cb79862d46a9183fed91bc5017dcb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802899, "uuid": "7e1f8b14-3ee6-4091-8f3e-c66ddf61c686", "value": "T1C444AE1133D0C432D09228768825CBB58EBAB47559265A8FBFD41FBD9F347D1EB2530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802899, "uuid": "410ab6c0-8c42-43ab-b7fe-3738656e9ecb", "value": "56620115eb6e0830bdf5b4ae97062a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802899, "uuid": "580547ff-42ca-4b80-9ce9-fc5524b4764b", "value": "3072:PYThou1EuQscm1jT9Qo6SKJiFzQgAGWQnhRAb/EEkRkRamPYjgV59zMb:gFouuq1HECxvnhOVqmIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802899, "uuid": "ee3af7a0-431e-4651-894e-8624a04f38b5", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802899, "uuid": "8043381c-b541-42d1-8439-ff6922add074", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802899, "uuid": "d3d92a8a-f257-44d7-bf82-b0fcd06c3fcb", "value": "5eaf686ef6e011e01baafec6fb976acc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0b2000-566a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638777456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777456, "uuid": "a9d7dbe1-6ae2-406b-9615-0f551195cb80", "comment": "Malware payload (Mirai)", "value": "7629992dd93aafe0bd893dbb4cf3584f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777456, "uuid": "0e570b9d-b23d-466b-ad4c-abc730e927eb", "comment": "Malware payload (Mirai)", "value": "2ef4edd9c090bd288b87fa91a10b5b20932cdee7affcbd3f3595626dc98f4fc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777456, "uuid": "6533ac09-728d-4819-bc0f-59e7827e5fd4", "comment": "Malware payload (Mirai)", "value": "2a743d0a13e61891475ad7395e3d8c725a174467", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777456, "uuid": "9978f6d8-7d7e-4277-99f7-3e11d52cc360", "comment": "Malware payload (Mirai)", "value": "1cb332074dba33eaf1d61b9da6fe170673a2681ec1eb9d3141d51473a78097d649dccacd331ca025466f7a112d72d556", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777456, "uuid": "fbbf4aa1-2202-4d5c-8299-b5d1e3ebe1b1", "value": "T14423F158C95DACC0E3F65EB82D3262D1BF7612601B9178C52086DF326D4A617F383EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777456, "uuid": "6c1fd6ef-b170-4155-9eaf-406991685aa6", "value": "768:S5P7lMa+QEWUxtggPznbcbdJUmhss9n174A7eP3aihw/KX6CY0jipbPyWA4uVcqi:YhRgxto5Gmys91MTP3Dy/KKCXjiFa4uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638777456, "uuid": "401daf7a-7397-4aa8-a835-f11478023909", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638777456, "uuid": "e2f80669-c7d9-45b1-ae10-1d96800598d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777456, "uuid": "b04281f1-e5af-463e-b32d-23529d03cd76", "value": "7629992dd93aafe0bd893dbb4cf3584f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ca04c0-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638765148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765148, "uuid": "0861304b-c221-4148-a277-08ef2f0685b0", "comment": "Malware payload (RemcosRAT)", "value": "6f78f5cf377470fc449263eaf2231dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765148, "uuid": "f1e929c6-f152-4f27-83d6-ec33c23c3e4f", "comment": "Malware payload (RemcosRAT)", "value": "2fae5c7782b7c0cf7e205c1cf79400ef3c88c261b51882fb7f5dadab37013cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765148, "uuid": "fee53453-1c87-409f-8ff9-d0e692072e35", "comment": "Malware payload (RemcosRAT)", "value": "067211e73b880a6a7c9c01ac2c309ea49579ad1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765148, "uuid": "ad21c1b5-77a3-4ce3-87fe-7d812a7c60ce", "comment": "Malware payload (RemcosRAT)", "value": "951f22fa545f30c60d001906c1bb0147c66c91d61e852f81293218ce2912b9fd4001de9f7944719d5771cacebf02ab79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765148, "uuid": "c91ab8d6-647a-47a8-a2ab-c0940ed4331a", "value": "T155B4D00067B0C034F5F756F85A7993ADA52E7AA1A738A4CF52D526E967346E0FC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765148, "uuid": "df6aea92-bff2-4157-b322-d7217adda494", "value": "5da563873972430c247e0379344310f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765148, "uuid": "1ac6e680-1186-4b51-8964-0d9ee0fe95c1", "value": "12288:EcyYl0UxnqkDG9erElduTpw0oj/F042BDhsqkLnhyGgF:R6qq/92EESj2lsD36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765148, "uuid": "5dfd8251-58fd-4d34-99aa-7f9903088f73", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765148, "uuid": "5ed247c3-84a9-473c-b1cf-d3ea37550858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765148, "uuid": "21343471-9f6d-4887-86ca-c46e636fc746", "value": "SecuriteInfo.com.Trojan.GenericKDZ.81096.27678.10459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f4a4fd-56a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803214, "uuid": "0680cdff-a68f-487c-960f-4583d7d80b02", "comment": "Malware payload (Dridex)", "value": "f6c9a4de540adab8a1129a284c35b0cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803214, "uuid": "2716ba3f-d526-47f1-97de-4b37d73e3584", "comment": "Malware payload (Dridex)", "value": "30068edcf209c6232b3dd085464c9ccdfad77d47dbf19d4efa7954be766046ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803214, "uuid": "3ab7889c-3161-4a03-b6c8-46bdb25e8ab4", "comment": "Malware payload (Dridex)", "value": "c93bfb3743440733b947acfb107665b4c729f587", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803214, "uuid": "05cbea87-8fa3-4447-9403-d171bd805706", "comment": "Malware payload (Dridex)", "value": "7978bc8a0713da95fcf6e55cd5d248b736bc84743bc061c625c6e3048da0e9dc6e48b53163e5107d13bebfe893ca7a5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803214, "uuid": "a3bb8ef7-bff8-4370-a041-56ec4dccbdd8", "value": "T11BA4BF4FEEF690B5FA32F8B174528292E1CB9C752002B7D485616A58FCE4C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803214, "uuid": "f2c4d2f8-4242-42b1-95f5-0ea55b0db603", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803214, "uuid": "2f446650-1b1b-4bb0-ba3f-269d14caa783", "value": "12288:VCfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWRY:VCfzehtApz4lzQvzU3H2Jz+BbAt3A1NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803214, "uuid": "40c87f09-33b4-41b3-b93b-32ff47cc9893", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803214, "uuid": "edb439d5-0b2d-4153-8b96-7263cd74aae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803214, "uuid": "677dc6f2-e5ba-43a2-85c7-2056f553fd9b", "value": "f6c9a4de540adab8a1129a284c35b0cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0aa296-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638802422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802422, "uuid": "061d1dac-032b-4fae-9687-8c00400b0471", "comment": "Malware payload (Formbook)", "value": "13048d08c1326562cfabec78e873dc48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802422, "uuid": "184b9e35-6baa-4584-9f9c-24f6b4509f9b", "comment": "Malware payload (Formbook)", "value": "301feb833a74e1b0a26cb92275a1537794075bd27f2ee38d272ede23e57012d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802422, "uuid": "ed8fdba3-1207-4541-ac05-7a0076f63617", "comment": "Malware payload (Formbook)", "value": "b98773cd2146dccfdc47db912c940d6e0617c1c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802422, "uuid": "7df8d5a7-84a0-44fc-bb56-8287ee18580a", "comment": "Malware payload (Formbook)", "value": "a487152ea3b0d4972f7e942e27c5b9ae18ce88a4a671bcaad79e706b2896601a514ed3faa950d0cc8cda671e44c87047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802422, "uuid": "58373452-c1ce-4275-aa17-42cd767cf9d5", "value": "T1A7A413D6334AC39BDC0E8BB44563C09623307A76AA15DA5E7DD1738972236163023EFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802422, "uuid": "a4cd8f17-1786-4699-8017-7189afacec55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802422, "uuid": "3c6bd7a5-fc4d-4c54-9d4f-bdd4d001d832", "value": "12288:axEDtD00BH+IKrMBTBnPC7eHoCWXI1IT:aqC0BHsGT0UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802422, "uuid": "75a9ce56-9ad0-48e0-918d-dc4a936f89f5", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802422, "uuid": "672c3c0c-201b-4c18-9636-6dba20de9d70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802422, "uuid": "78ac2a6d-3a8f-49cb-abd9-9aedbb57839f", "value": "4kbibCcqzUNUMlT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d4aea0-5693-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638795369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795369, "uuid": "16871c45-b054-47c6-88ed-594beb8af15b", "comment": "Malware payload (RaccoonStealer)", "value": "2fe5b015885d9a081311bb75c422be33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795369, "uuid": "d30a76f8-8e98-4653-8723-048f53a154f3", "comment": "Malware payload (RaccoonStealer)", "value": "304d44b59e457f07939380678b8fb59b1f6b4bd449bcaacf87aa150c3fa311e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795369, "uuid": "3d932da6-a932-4207-98eb-b500fe48093a", "comment": "Malware payload (RaccoonStealer)", "value": "bae8b4b6635fdf08322c0e12a154446a5562b66e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795369, "uuid": "f808e683-2ead-44d0-ab91-c232700087cf", "comment": "Malware payload (RaccoonStealer)", "value": "fe7d9870cdc85de37f93b0d4d3be705523d7f38e51f9270da06d5057e4e45712d0933eb5685b33644255421630e16605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795369, "uuid": "ada893ec-af41-4247-ac91-d06a3191f3a3", "value": "T144549D1133D0C032D59329768425CBB58E7AB4716A666ACFFBC42EBD9F247C2973530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795369, "uuid": "db91d222-4442-4da8-9a00-9e361fc337bb", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795369, "uuid": "968aea16-81a8-44e3-ac9e-390a38394ed9", "value": "6144:x+A1RXKM6p/3wppTtvtNAxosJZ0HTBiAP:xrPXKr4f9tS3JZ2lP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795369, "uuid": "5bc7c85c-9d09-4a58-9cbe-58c341b59710", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795369, "uuid": "2c947943-095c-4a70-813f-3938bf84e76e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795369, "uuid": "f05a6b61-1853-4143-a113-6f68e5305eb5", "value": "2fe5b015885d9a081311bb75c422be33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d968529f-5644-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638761424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638761424, "uuid": "fe5b1293-a8d0-467d-85ea-a3cfea2973b7", "comment": "Malware payload (AgentTesla)", "value": "90c27fd941161265e77a6e2d88515efd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638761424, "uuid": "0243cb1f-43b0-4703-925a-322c37956a4e", "comment": "Malware payload (AgentTesla)", "value": "30a8fd72ef16547dba5a0f75c3f395ed0d7c2d3b5114fabb8285910597be77ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638761424, "uuid": "9f50b512-f0db-4c66-beae-4576b13d3a7a", "comment": "Malware payload (AgentTesla)", "value": "7a21cfd7d2ac238626ac8acbdf45b9fd79c105a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638761424, "uuid": "259159cc-3a99-4e68-a1f6-388203312bdf", "comment": "Malware payload (AgentTesla)", "value": "442f336faec09c7a03362453a03713b7c84b4dd8c7b90dcf3f65c7fa9987be6a57507edcf396c392923f72ff5271c088", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638761424, "uuid": "f05cb5c7-c1f6-4107-b398-1959cf8130f2", "value": "T11D557A2D25B5096BE97D1A34442147374EF26D3D9877E7CD3B88306B0BB3A840A267ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638761424, "uuid": "834632d9-9c84-44f9-b14e-51b3a2b2ee29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638761424, "uuid": "663b0777-ab00-4111-8b87-3b6884256a55", "value": "24576:JHskxtqcSNXJplBXhr3yF4a/9yD5EZO6sBPScDL7:JHsVNZpJfEZOZPScDL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638761424, "uuid": "82d06106-0500-43a3-a217-58508e2c2a78", "value": 1398272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638761424, "uuid": "b5fe8302-dd94-4f7d-8318-19155769a4bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638761424, "uuid": "279fcc91-d4aa-49f9-b521-0cd1a8894893", "value": "RD590008_EN_115538_BK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07211eee-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638782117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782117, "uuid": "bc43b3de-f735-479a-8e05-6caec80b6e26", "comment": "Malware payload (Dridex)", "value": "20988d1d1e546b5ba58346e6f5aaa002", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782117, "uuid": "9c7b2bd4-2f4e-4db5-8ffc-bc08ddce1026", "comment": "Malware payload (Dridex)", "value": "30c938bcf64e0dae4efde1256a34bdf2b92cd50b8f01e63013cf128fdc9eb4eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782117, "uuid": "0b78c8a9-a92b-4080-a685-0969322c02d0", "comment": "Malware payload (Dridex)", "value": "23173e1237888874c1aa4fa6e1e4798ff2b54b65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782117, "uuid": "3a57cd2b-45c0-423c-bc80-7a8e04c6eb75", "comment": "Malware payload (Dridex)", "value": "751e5edcd785f269a3cd08c9a5691aca671bfece63de5cf7f7b295a344746d64b3f670608474bfaff500990b87d120e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782117, "uuid": "16e754ae-b4b8-4bb8-bc16-f5e3a4bc7fc5", "value": "T144E3016F1BF6C919D733A87D840E1B673393948748D23AA2E281B5CCA187F7225E53C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782117, "uuid": "fa579dce-1534-4190-94c8-dbebe5085753", "value": "3072:+anbPT49m1QKwdtdF1M16TguaNTLGmtLUGSN/tpA/KAhqf8ZI9dDM:+ab749mDEtG+kLGmxipuKA0fLdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782117, "uuid": "e4dac4d0-2f27-413a-aceb-c7cf1e49ee8a", "value": 144021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782117, "uuid": "d6966dec-b8ae-4b26-a6fa-f1a97612520e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782117, "uuid": "45be7aa3-3fce-4d79-9d57-d94d2fd97d82", "value": "best offers_898602769311.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936fe2fa-56bf-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638814135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814135, "uuid": "3165690b-885a-42f8-9238-5d6d3b2b0667", "comment": "Malware payload", "value": "6e80956216b56ca9ae989bb6644b1d21", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814135, "uuid": "de06b863-d743-4740-8f40-c0462f1ab56e", "comment": "Malware payload", "value": "30e836e36f543fdae43f73847eb5dfc74c8322d50a5f3bf50a125bc1a87ac7ea", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814135, "uuid": "79fb76f8-6b5c-4f7f-b5e7-5545aa6bfe96", "comment": "Malware payload", "value": "b52211dfb1bc6c84c94ba987073fd73777190e05", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814135, "uuid": "80eaf993-5610-4569-85d5-5c70b1bd1142", "comment": "Malware payload", "value": "1963195736ecf35d53e4bc574ca9a76302e01ff2e37086613c0fed743d69e40f805de2aa972f5aa8c7f8f2a49263f17d", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814135, "uuid": "edd5b0aa-5668-4aa7-b454-1c188a9be70a", "value": "T177D46D55BECA6EA1EFBF47B78361D62D1126736E03A0A6CF6603019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814135, "uuid": "1034ad63-1096-4e52-9154-d6f40e21036a", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814135, "uuid": "ea43334f-fb5f-436a-97ec-a2c11db12ca2", "value": "12288:e0Ws7IMsR4yVld8bzbBSre9BY4ZyrE7K3yl8PeVooA/AB2LEJZLoCAQPUqjO:e0bskX1tBY4ZyrE7K3yl8PeVooA/AB2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638814135, "uuid": "4f81af0e-83c7-49ca-b66d-9b138aac75b0", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638814135, "uuid": "e32c9621-f6d8-4592-a166-fa84fee2c1a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814135, "uuid": "09a2c2b3-529e-4c17-971a-f7399604b29c", "value": "WellsFargo_Report_21126432.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2430d8bd-56b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638810942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810942, "uuid": "8b6e6fc0-809c-4f0f-ab37-46226d50b512", "comment": "Malware payload (Vjw0rm)", "value": "984625a78fa53429488c73ff65162c61", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810942, "uuid": "0386794a-1c10-4abf-b57c-07443df4653e", "comment": "Malware payload (Vjw0rm)", "value": "314a3c832d11f9cd4cc2d58193f3703036918f4b1634257cc3b2ec3a19f5374d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810942, "uuid": "22a0860d-5092-4df2-abd6-5f5ab556f51e", "comment": "Malware payload (Vjw0rm)", "value": "5a14d8928a3d6b9d43d1d3bb6d956e2390fa50a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810942, "uuid": "0c6c2eda-ef98-4d22-bf08-aab144316b30", "comment": "Malware payload (Vjw0rm)", "value": "0aa199a648068902e598d5218fc8541cc3c0c206bc37d123fafd6e454e76e168153f94ac32ffa1ab527b43e4dbbce562", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810942, "uuid": "9a0c6c0a-72d4-472f-bb00-d7e4db5e0b8a", "value": "T18612ADEF41450AB44E210B992A7CDF08372CA2516217F4A4ECF65257118FFA379E6E4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810942, "uuid": "d78e076c-167f-4601-aa3f-52de0b9e44de", "value": "192:3xSPJwfCK9yguwnXSMvMdS6e7joqwZxRHERh7mv6dO/zh+mH46:kxhK9y9mXPeSjQqwZ7mh7yII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638810942, "uuid": "a057a68e-fb93-4a3c-b401-2b4b7191a48a", "value": 9524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638810942, "uuid": "cfb9dba5-495e-4cf8-9650-a3efd8694bbb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810942, "uuid": "cba963da-d2cf-4abf-a613-27a396572028", "value": "#VSAXUM01_Payment_Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cba7b7-56ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1638806052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806052, "uuid": "3f93142c-a106-4a4b-9f4a-45a90e19bcaa", "comment": "Malware payload (NetWire)", "value": "01f475b83be658bf91012c4ffcbfccc2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806052, "uuid": "4a16bac6-90a9-437e-9693-cc9dd100c35e", "comment": "Malware payload (NetWire)", "value": "315361d4b71c5cbdd11076ce30cbac544eaa96f3ae42cc0b4d6f9d2e6decc6a5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806052, "uuid": "7b1d9ff8-85b6-4b82-97ed-8b6254c86cfd", "comment": "Malware payload (NetWire)", "value": "5638f528926cd1e2f5b52683325e49c7624d34ff", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806052, "uuid": "3625c49b-e190-431a-84f0-bd8f0b791892", "comment": "Malware payload (NetWire)", "value": "4634fc5ad6ee234265e55f6649953619b92bd14f368c7d7848c431b27279185320958b50485c1985a983f93566236057", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806052, "uuid": "607c2122-0150-4dbb-86a3-8d6c05fedb78", "value": "T13E62DBADD45702988F8AABB82B2F6F44118D792EF784D13372B8573467D2D3A512383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806052, "uuid": "f4007de0-7119-4f80-a1ea-4eb92727f3a3", "value": "192:kmWjecYqGcywS+j+S5kc2VTReV0dj9lw32EUWBLzxewetU4qpX3Ts:kmWjjYGy4+Sac2VdeVULu2xWxzktBGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806052, "uuid": "6ef9347f-b08b-4229-bd77-0a709f9fa592", "value": 14831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806052, "uuid": "4b23d220-582d-4f8f-a809-54cfc55da021", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806052, "uuid": "fe1d61dd-3732-4ded-8c88-29581fffe997", "value": "RFQ 6122021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87187f99-5693-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638795216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795216, "uuid": "b704e68c-077d-4e9e-a412-5b90d4db5eac", "comment": "Malware payload", "value": "71a56114978b7553d1e9cdcf37f8e2fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795216, "uuid": "29758cf8-9f83-4e84-9401-0fa21b5c6cbe", "comment": "Malware payload", "value": "3199f52ab04d396c92f16d2ea677542965fdd892df0534fcdc097c0d1d0d1209", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795216, "uuid": "6a11f0e0-7c04-4ba9-8ad6-9b7845c8b30f", "comment": "Malware payload", "value": "a5c8ebe1826be24e85cdf8fdeac6dae09f58b3d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795216, "uuid": "302cc9e9-4517-4108-8f84-b33e9d2bbaff", "comment": "Malware payload", "value": "60d5b8737758106582d7b3f1deb9a13b10faf4a0e967f04ce8e82bb2e01c9dbdab187c583c98543fef57f89ae880fb2f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795216, "uuid": "08fea41b-c080-4a57-ac41-cbde83801a82", "value": "T1CC346B02F696C030E1F700B30B7586760ABD7D31A39AEAEB5BC9199947719C0B675F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795216, "uuid": "facea2e7-44dc-4beb-88bd-3e35c811dd15", "value": "bebd01bc297e24a3d3e205e4875b9d95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795216, "uuid": "04b7269a-4577-4378-b8ac-1956eb376812", "value": "3072:G7DJ1Pa3TPqbDabC8ORicyt+9VwepEGwE9ISB1jtDff8AO+64d:G3PijS30f+9VweCE93pfzJ64d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795216, "uuid": "2c268a26-fa18-4bed-bde7-400972945d7a", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795216, "uuid": "067f90ea-c162-483c-902a-0ed5885d6e34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795216, "uuid": "b98838dd-cf50-41c7-b079-1ac8834ff4de", "value": "SecuriteInfo.com.UDS.Trojan.Win32.Inject.25291.12437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3a0f76-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638776243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776243, "uuid": "b423c73d-3cbf-48f2-9030-f242be5670e8", "comment": "Malware payload (CoinMiner)", "value": "9cd1c34b6f6af310fd9e5e7056bebb51", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776243, "uuid": "0746f5ee-40da-4602-9499-6cc52df2316b", "comment": "Malware payload (CoinMiner)", "value": "31e7af388e46bad588bf2379082be9883c32d4b4800d162ffba41d703ac1324d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776243, "uuid": "f238f6a6-51f1-4c21-adfa-ae8456786b52", "comment": "Malware payload (CoinMiner)", "value": "6b36c7c843904bac316b062d4eafd90340e6b391", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776243, "uuid": "416c4284-9fe9-4410-b6ab-f30a9727c7a7", "comment": "Malware payload (CoinMiner)", "value": "c42dbfc6662bd6bc5c133794b096c2d1394ce1ab3bf5beac1a20a77eff436cae91d1ed86e4b9d8381b4ec6dcffe1ce46", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776243, "uuid": "953ad871-700a-4907-956c-f1af1bc7cac2", "value": "T142663355AF468850C895D1B0845621AE01F6AEC15AE347DFC5183F2F9CBBD7B02AEFC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776243, "uuid": "2722eef7-4246-47a9-b7c9-2bdd9348346c", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776243, "uuid": "1c9ca772-0c9c-46bf-9572-b7bf35fa19c8", "value": "196608:qHZaxbKeIAzcrSGK1LDKHaFdHl5t8oYi+4:V2eIAzLqIlu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776243, "uuid": "0492aafb-f734-478f-9816-8ffec49cac5f", "value": 6645729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776243, "uuid": "0c63c757-fb1a-4316-9172-c419c6cf1829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776243, "uuid": "5abc8e0e-6926-492e-b8c2-9de149c432c5", "value": "9cd1c34b6f6af310fd9e5e7056bebb51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a590a82b-5694-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638795697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795697, "uuid": "46a56e7f-cbc3-4f68-9a4b-916fee66134b", "comment": "Malware payload (CryptBot)", "value": "e728a780658baeee278607764b7dbc5a", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795697, "uuid": "05460c78-d34a-4695-a0b7-1569afc431c1", "comment": "Malware payload (CryptBot)", "value": "31efd803dbe615e98301fb55c581fce281b1a8a9e5f213f5d834489b30cee4d4", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795697, "uuid": "919f7002-8596-4db0-9b41-2bed3a4e5df2", "comment": "Malware payload (CryptBot)", "value": "29c4a4d385c988af1f6b2017be70f8fecc030365", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795697, "uuid": "a615349b-cc09-4f53-81e3-5005d292d52e", "comment": "Malware payload (CryptBot)", "value": "110016b3a56bbe629469958a27339b70710a34acb8d0bd5df3a35210839a8fe68e3faff8293bb8f53ee1bda5cb98365a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795697, "uuid": "ba3f504d-15ce-4cdc-8491-f582a8edea3a", "value": "T1E584DF1172D0C033D48664B68925CBB15EBAB5751BA22ACFBBD85FBC4F243D2972530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795697, "uuid": "e6a635bc-7aca-49a5-b9b8-34e97ad88112", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795697, "uuid": "b51e1f5a-0a53-4bfb-a300-21776b80227f", "value": "6144:5lOJicpNou1JOBsePbqsthzDVXFmdV20Vp3yAxGZVlFRTQGW8aPA:5A/pNJKvbqsjzDVXYa0VpinMVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795697, "uuid": "6c4b2417-df7a-41c6-9f20-6d23e07f6b20", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795697, "uuid": "7b38dccc-7e96-4ef5-ac26-b83f18b7d60f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795697, "uuid": "383c552f-dd5d-4bf3-b92a-63422b1e735a", "value": "e728a780658baeee278607764b7dbc5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f8c486-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638775484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775484, "uuid": "949f8d44-6a70-4575-b61c-e231c8f8b9a8", "comment": "Malware payload (GuLoader)", "value": "fbc7311c4226c02795409b1bda20257f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775484, "uuid": "3b6db675-c0bc-4682-bd9b-fe53d5503791", "comment": "Malware payload (GuLoader)", "value": "31f9eae7db64f3bd45694737422f5628e2e43294c2d4ad8bf8ff460119ccb71c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775484, "uuid": "67f1e661-538d-4038-8df8-610b10ed9fb4", "comment": "Malware payload (GuLoader)", "value": "cb6b820032c67f35201c2a1296dc31188f07768c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775484, "uuid": "3e437d6b-41f5-4ac4-93db-dce5e6ca6fbe", "comment": "Malware payload (GuLoader)", "value": "808542d368ad3cde314ce12b7883331336a8da68c5de437d3812b668d89db44b6d99aa6ae311ab73d455caedb7d0b783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775484, "uuid": "279e2b61-e8f1-4fa2-9611-bdb7a568ffc1", "value": "T1D5E39D23B2531D14F9D3CEFA1D32A9996A327C310671EE5B45857AB82431283B4B5B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775484, "uuid": "83baeb1a-650d-496f-99b7-d867f227ac56", "value": "11394f41740989a66842cfb21a017479", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775484, "uuid": "ebcb9b34-6193-4f8b-b347-b28437b363b0", "value": "3072:6IDcHXAsBtRf5cKc6nE98jb47xDnA3PXT:6PztRBhE5xDA3PX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775484, "uuid": "01c7ef64-4163-4a42-b33a-e2b24bc13221", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775484, "uuid": "4c9c21cb-e477-4739-b823-152e678296f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775484, "uuid": "40f25786-7461-4e81-9dd9-b1318983a45d", "value": "Original Bank Docs 12-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42dbc2cc-5646-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638762031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762031, "uuid": "e0448bd6-d406-484a-b4ba-f5944f7f60f3", "comment": "Malware payload (AgentTesla)", "value": "f871be84962d15ae582c31d102027200", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762031, "uuid": "92382429-b3c7-4bd4-aa09-4f2740595c96", "comment": "Malware payload (AgentTesla)", "value": "31ff4ddf4da524102eadae3a947d906669829b433df210ce5a2a56eb920a0c99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762031, "uuid": "0acfe347-b07d-48b7-b238-f876a1439407", "comment": "Malware payload (AgentTesla)", "value": "fa8377d3c008735c2eeb2be683883882dee8c7cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762031, "uuid": "df30ab6a-2fda-4f41-bf7b-57d0e6c427bb", "comment": "Malware payload (AgentTesla)", "value": "45d6a4637a1f5723232a19e2c15edf44c84dcc516840532fb5360e17bfe9a2fdbe234567e1636e5f36aafa5a639a92c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762031, "uuid": "6b77318e-de42-42b0-a212-4baaa9ec5635", "value": "T1A5059F6AEE5E3B40E39C863AC0D1A8B842B58C619611D93FADD431EE45F1ECC116BDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762031, "uuid": "f69aa76f-9c41-4e74-9ee2-c474e3811fc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762031, "uuid": "d93b450c-adae-4712-87b9-cd091373408e", "value": "12288:5ItyKntK4qZfpSBDZvwwew3LEbZ27y9YebcDse2AngutINLsiuxN6tTM:aPLqZeDZILw7EbZSUtuswn/tIBsiNTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638762031, "uuid": "88f2a4d0-c415-448d-8345-1121eccc934e", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638762031, "uuid": "0a3101e9-d75a-4c82-b123-4e6d0cc1a00a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762031, "uuid": "a617e092-a184-4bf0-94f8-1eef907e8580", "value": "payment advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dd6f1f-5688-11ec-96a4-42010a9c0029", "comment": "Malware payload (XpertRAT)", "timestamp": 1638790379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790379, "uuid": "06295796-2183-4da8-b1e3-589fa85e02ae", "comment": "Malware payload (XpertRAT)", "value": "b8c759b59611c0776e62fc70aa89ffb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790379, "uuid": "8cb1bf21-9599-4cf8-9336-32f91f6f3bca", "comment": "Malware payload (XpertRAT)", "value": "325a8b36cd43c91d8a678907611a8ec5c78719809cf1a4cdb3d03f84de59ec50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790379, "uuid": "08231170-c569-49d9-b656-286e35e77737", "comment": "Malware payload (XpertRAT)", "value": "bb3841b237127c1654d602283026996f62001012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790379, "uuid": "b85602f8-10e8-43ec-8568-1b219c940ecc", "comment": "Malware payload (XpertRAT)", "value": "3963d996cb79dd3d0de756bef793afbd63c1c31c5932d05c69ad15ade1262ab338b94bf28ef988297ce0f832926a79bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790379, "uuid": "6bda032f-cd03-4b6f-a1cc-929cc14e6697", "value": "T18C556A5C317025AFE83A853145541F3B9EF12C7D966B53CE7217309F8ABE9828F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790379, "uuid": "d7078696-d38a-40c4-94d0-f499951ab5c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790379, "uuid": "83f1f313-cba9-4e3f-bb26-dffaaae52747", "value": "24576:vXyLThHEgYcS80Evqe/eDyqeTH9C4107M4H9ru:/yLdHEV8xvpeDyqeTHb10r9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790379, "uuid": "c7cb2ff4-4de8-4e11-bb9a-99dc01e93cf1", "value": 1352192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790379, "uuid": "a5ef8b0e-2a65-4396-8cb6-47be14a2b06c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790379, "uuid": "2b8dfdad-9a59-4f69-bfbd-7ff983d2f33e", "value": "Cotizaci\u00f3n ref#8024108130.pdf(89kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c194202-56b2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638808512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808512, "uuid": "6407d993-7e49-4dfc-ba84-eeedc4266f2a", "comment": "Malware payload (Dridex)", "value": "d9dd91073af26cfc66cb62d42a745401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808512, "uuid": "120df3cc-c0fb-444f-afcd-34cb0f4cd1f3", "comment": "Malware payload (Dridex)", "value": "32e6090617d7d8889307524f08db7aa84291be954907b016f700b13b99754a56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808512, "uuid": "8126c9c0-f890-42ef-b469-8cbff7f14fb0", "comment": "Malware payload (Dridex)", "value": "1684d24daa8ae7c34029e35104a99993e16048b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808512, "uuid": "c32ece3b-0654-4704-9b5a-112e15161cc8", "comment": "Malware payload (Dridex)", "value": "8483f1429039cf8942c0183d7e89347b31601ba692ddf0c1665a17d08171c537b7d5e8ebeafe12fd9c334877e372b0cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808512, "uuid": "8565ec06-5b5f-4da9-8150-6030182ffd37", "value": "T152A4AF67D1A2CB1AF5CCA2F3921A018ADDB64A8482F547D40CE8DC564FB7687F1B0D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808512, "uuid": "3946576a-9a9f-452a-b4a4-e13c18ef9662", "value": "9259df85dc28e34e237d850d94b74d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808512, "uuid": "4372c5b7-8bdb-49d8-a6ff-b254c002b4b9", "value": "12288:NGAe6zhjzhVjTJVFRH3m0K0JRkyVnochOENqef6enkebi6t:NtDzhjzhVjTJVFRH2L0JREn9zxD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638808512, "uuid": "c4d5636b-d924-49c0-96cc-5436ff1ac401", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638808512, "uuid": "1dcbfb0e-c1fa-4c04-a456-0fd134b915a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808512, "uuid": "6b17e324-87f5-4e05-b790-da816bc3a1ed", "value": "d9dd91073af26cfc66cb62d42a745401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956f07e1-5698-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638797388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797388, "uuid": "7e500331-9837-494b-b146-ee01c0d04a6c", "comment": "Malware payload", "value": "a0260102d8e45bf38e4d79b8995fcfa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797388, "uuid": "2bada822-346a-42e6-b940-4c0966c825de", "comment": "Malware payload", "value": "33205c1f60b0cad8cf253b52b092c2a4900ba029fa99000c2385acb472f3e583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797388, "uuid": "aa4a6309-8d42-4a41-a381-1a04370be4c9", "comment": "Malware payload", "value": "1e9c0be6f1784937bd9f574c23d04c988750ab24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797388, "uuid": "b8dce269-ffb2-4b06-b757-30555ebb44d1", "comment": "Malware payload", "value": "0f99c010e3f044333bc2c60c532deda10a7136bef412f458eb69a92f46b1730a1b4c61f321d5e162aafd57c1c6324964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797388, "uuid": "aadfe16e-4745-4ea7-b101-c4c244e068d7", "value": "T158A3F28BE3E009F7D0F2D9350EBB32AEE6FAAD7619154BB715601C4D6A383809C45367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797388, "uuid": "4643e6a5-a68e-41c5-8b53-3528f1a37582", "value": "d609a88c9c1c0b83071e61f9c45f78d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797388, "uuid": "8945dfc0-6482-4240-af83-b725033e429c", "value": "1536:s2qyK6nJjTpvWzt7p8AeAPJ2+Z814UZ0ga5jKLufTeP1wZ0DVHZVSyxnYR:lrTvWzt7p8AeUwAhqRuyP1wZ2HJWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797388, "uuid": "4c170d70-7cbc-4e00-af72-c824e72133cd", "value": 98189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797388, "uuid": "0838db43-0b38-41ba-9724-b756005f4910", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797388, "uuid": "5bb74185-9802-443a-baa6-1ddf4102eb95", "value": "a0260102d8e45bf38e4d79b8995fcfa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29d8625-5674-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638781975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781975, "uuid": "2e3b988b-2963-42a4-99d5-f054ddc30cfc", "comment": "Malware payload (AgentTesla)", "value": "1dc3f2b5c75294d1944b8518dddd4748", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781975, "uuid": "f28f0179-6dd4-4675-89ff-f348207064b1", "comment": "Malware payload (AgentTesla)", "value": "334f0705461a4db6e447b9b992e147e73ee67a5b26a8936a9b56febc7410d584", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781975, "uuid": "e1385fc5-962d-4aee-bf97-3f8c95e693cc", "comment": "Malware payload (AgentTesla)", "value": "98fac00bc78ae9890e98a67d2818578854d7897c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781975, "uuid": "06a79c9c-ce5b-4081-97c0-2aad7cfc716d", "comment": "Malware payload (AgentTesla)", "value": "d662bbd8ea6174827f338aa08e5ea9b726e19dee8e5ec5e90abb35b34a54d84818c6a4fde38e02541f3a03a9c02f6eb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781975, "uuid": "d194a104-c20a-468b-9487-75124437770e", "value": "T180956A5C313025AFE83A853049541F7B9EF12C7D866B53CE721B31AF8ABD5468F242E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781975, "uuid": "a0c1f12d-9b77-4a80-9ce5-aa4c02cd4570", "value": "24576:/aAoSLwdipTDFn7viIGMQwoVxlxsH5h73+OalDRqOWqDaTzrcZBDVwMgM:SuLwYpTDJ7qh77xc+OaJR/WbzGB1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638781975, "uuid": "fb1be010-1897-49e8-90ae-18912d94d7bd", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638781975, "uuid": "b98a9db3-a5bd-4150-889c-82cc0450aeb9", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781975, "uuid": "3bcdbb11-affc-46f1-9555-c13ad4c44222", "value": "Ordine RFQ-PR80-90502-PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c134ba-56cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638820122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820122, "uuid": "56b15c95-8987-492e-b14e-96190c651756", "comment": "Malware payload (Heodo)", "value": "990c002e919c018be46a33f991dad7c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820122, "uuid": "5cfb4c40-e2b4-433b-8d65-e269f83acf74", "comment": "Malware payload (Heodo)", "value": "33a667a53ee971c2aac6854712738df3fe77cf31eb6c7c8b3f011063a3166dee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820122, "uuid": "a3378897-92d0-4c09-8ecc-443c99987280", "comment": "Malware payload (Heodo)", "value": "9c65b1befa7a24613984e52c6a78f0ea8cd69a24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820122, "uuid": "e801053f-ace6-4303-b34d-2a9dacf09d99", "comment": "Malware payload (Heodo)", "value": "e403334b70ebde1ce7e5e0e6c23b0e6c7fa5ccc6d35c5220869739878b72391f4f38acf90cc50e7aae10be639c5cc984", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820122, "uuid": "fb5d1837-3963-4ddb-97b5-5135a9217713", "value": "T12BF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820122, "uuid": "32a9aa4f-f1f9-4714-9dd8-095a2a2ca4c8", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820122, "uuid": "d43d9d1b-2600-4ce3-9fed-81d53cc7e323", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/d:JapiKiBEmj4GbOX399Md9J/0TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638820122, "uuid": "65ae1f42-8faf-4dd6-b5b0-9e5be34bc2e5", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638820122, "uuid": "ccd82b6f-0f9c-4953-9b1d-d856673a96b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820122, "uuid": "11bdbd5a-9c2e-4659-85ca-9b65f9fd8acd", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614ec1ae-569f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638800307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800307, "uuid": "dca84a40-ff4f-4666-974d-19fbb10a07ae", "comment": "Malware payload (Dridex)", "value": "b8875df89fabedcab476fa41a2d0ce3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800307, "uuid": "570c7614-ac1a-43eb-8694-d84ce31cc2be", "comment": "Malware payload (Dridex)", "value": "33dbd70f8f7cc2a6f040b6f6ea3e973856cfd5b1077741cb3b2ee14754aa015a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800307, "uuid": "2699a96e-6151-44d1-a855-babd196264eb", "comment": "Malware payload (Dridex)", "value": "114381765ca7fe6a3e0ed20c6357edeaf4fe1e92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800307, "uuid": "598f8db0-db15-47d4-a3fe-ce6f9685be86", "comment": "Malware payload (Dridex)", "value": "8ff4e7df5e0664f11782fa57830311d5160df9d259aeb25f8089a9b7015c636f44f8ad08e0661fe135728b039f66af77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800307, "uuid": "ec6541be-8975-4cbf-9b80-663a0d5268a5", "value": "T13AA4A0469D16A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800307, "uuid": "7605d8f4-c9a0-481a-9079-922adffbb752", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800307, "uuid": "1ab44364-a15d-4076-b62e-f120ffdc7859", "value": "12288:U7fimEsIsmY4K08oM1Wd8t5KQhNdv5zK:U7aVRBn7x6jto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800307, "uuid": "1136385a-f50d-4e0d-80e3-7f4bcfb4b50a", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800307, "uuid": "b0eed9b4-9e17-472e-b34d-6c59a989eb9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800307, "uuid": "1f6deecb-8bd9-4161-87e5-40763505942e", "value": "b8875df89fabedcab476fa41a2d0ce3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae94d27-5668-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638776835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776835, "uuid": "92be57d3-b0ac-4147-9fef-73a60b2e6545", "comment": "Malware payload", "value": "35718909f91d0229ab56cb060cb2284f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776835, "uuid": "849f3459-edad-4461-9ee0-00a9b6dbf352", "comment": "Malware payload", "value": "35063dd7540ad35ba887d756e2f9e8faffa14e77d7108c27327865b3fccbf6fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776835, "uuid": "0bc916d7-566a-4f45-824f-c1bde2e9d7da", "comment": "Malware payload", "value": "454969916fae7b806282ab7789a3474575e12eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776835, "uuid": "9f757965-c47a-4909-88ce-b2cd3948046e", "comment": "Malware payload", "value": "e58d6decab9b27938bf067eae429e753925f81b24ca85d22f2cd780b7429b064e32306d9d2cf4796b060b8b4fed6b00c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776835, "uuid": "39cf0413-2ee4-4f57-bcd8-cfe253d8f3ef", "value": "T1A2A39E12B6208613C4E83FF29BFBC6F102F37997BD74CA1E7485A71E2EA211A6513315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776835, "uuid": "7ecc05cf-b0d3-4a36-a31f-26104ed9fd10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776835, "uuid": "fb871310-be90-44c6-ba2e-a96a52fb38c0", "value": "1536:bSMuB0sOo8bRDbXMVAhr5UP3iYIoygMZ1gN+jMZglkhttxrgbuiV/qok9i0eIOv/:W7v8bRHXMVAhrafrEZ1Q6Qok9xR0Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776835, "uuid": "a44ab28b-cd2d-40ca-ab6d-a1fe1985cc5c", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776835, "uuid": "7c1a7a8b-7480-41e1-b291-d292f84d46c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776835, "uuid": "29ff7c5b-0d0c-4e63-a8d8-2946ef143850", "value": "35718909f91d0229ab56cb060cb2284f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4224d4fa-5676-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638782645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782645, "uuid": "46d5f354-0c13-46f1-b561-e15ab0042027", "comment": "Malware payload", "value": "5cffb281fe8937f26e4994f8133f7456", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782645, "uuid": "42c7966d-8730-4418-972b-bb7546cb23fd", "comment": "Malware payload", "value": "3609272795c8f8ba1275959d1457b03f6143efaaf8cd037547cd561e68763237", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782645, "uuid": "62cc52b3-45b1-4032-bd6b-8f6c8c9be16e", "comment": "Malware payload", "value": "5479ddb635bf9c9a5632955c7d2cd2a6047256df", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782645, "uuid": "7412d035-f710-4770-bed1-46bbd11b8df0", "comment": "Malware payload", "value": "3ab1d57e7e4d83b3ef2706fb79b5aeada6d1d0be90a133174c7d2a63e5015930d464bc7a34201d30d063ac4de72797d7", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782645, "uuid": "b7b09b43-84c4-4a9d-8192-ceb8283d5a29", "value": "T160F48D3DDC69123B87FAD32DC6C94A0BF0915557321EAD0E94E783C6866B2C3B9D112E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782645, "uuid": "02cad960-b666-493f-8aeb-f457c99f92ab", "value": "3072:TvbHBHuWqVkLgLSmwJIwMauWqUB2mjtP/JFsv0aMuuDnf35MBdQxveXmAW6Hi3oP:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782645, "uuid": "2fad1d0b-4746-47ca-b686-3a9842d74ba6", "value": 758134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782645, "uuid": "37fbfe70-55f9-4d61-b947-f0de6a86a18f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782645, "uuid": "aa05a168-114e-4f58-a059-882f2c1ebb86", "value": "bm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214ae0c1-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638782161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782161, "uuid": "488676fb-e000-470d-b8dd-c0928af8ebef", "comment": "Malware payload (Dridex)", "value": "e5ca86bd5080d9c93e5cc392fa5498b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782161, "uuid": "c92c1fa9-ce73-47af-8fad-ce5ae1cad5d0", "comment": "Malware payload (Dridex)", "value": "370258df641d0688aba764d7812bc26270c46612966516342b1ebc03e390888f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782161, "uuid": "a6d188fc-9281-4a69-93e8-0e1baa1ec3aa", "comment": "Malware payload (Dridex)", "value": "53af11a5242edddc6b4328669bfc679463aea14d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782161, "uuid": "1b876b9a-0c4a-479e-bbab-241137b30a34", "comment": "Malware payload (Dridex)", "value": "b6c81ab0d8c69bc7f4f1bc10a83c8b046dc94d2b5cb634436221d55d37c20bd4dd48f18a1ee9313195e7eab8b224904e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782161, "uuid": "42f1f007-f960-46ed-852a-121502122895", "value": "T1C9D3015B0BB2D448CB37E83E906D0F96B733801694E62AA3F551E08DA183E7321F57D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782161, "uuid": "7c102041-611b-4854-a2d4-d6217b4d312f", "value": "3072:wytvKTSjtx+U+8F1M16TguaNTLGmtLUGSN/tpA/KAhqf8ZIuBqd63:/ty+jq+kLGmxipuKA0fHde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782161, "uuid": "ca590c95-06e9-4505-bffa-ee507a8efdf5", "value": 136202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782161, "uuid": "3c6c722f-252e-46d1-8774-74faa357e92c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782161, "uuid": "ebde3674-3412-4c1b-aeff-84b4db2e2b5c", "value": "variants 6982370583.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd35691-5696-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638796382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796382, "uuid": "99ebe8a5-0201-41fc-b2e0-d8bc0f89caea", "comment": "Malware payload (Vjw0rm)", "value": "0991692cd73649b4f98c01da809161b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796382, "uuid": "c97a163c-0645-450d-bd11-d040d45721e6", "comment": "Malware payload (Vjw0rm)", "value": "376bc1eb4708fdc95761cc9fbe5c2494b8af7781a962ca41c3951c3938e508fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796382, "uuid": "a0dc3075-6c17-4de3-b6d7-fd806872e4f4", "comment": "Malware payload (Vjw0rm)", "value": "f3bf288f04eeae3261789028ecc05888e17e55f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796382, "uuid": "38979ef0-3abf-4365-8eb6-647f9cb60819", "comment": "Malware payload (Vjw0rm)", "value": "c48806b61972f4367b0b91097de780e3ad7ed962c1c4a2534dc544c1406db270ed0afb4123f3bccad1620931baf4bcf8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796382, "uuid": "ff091b50-5cce-4aa3-a282-5be22c91ba44", "value": "T151544B8D6983E2DDC61BE23130F92ACE1BD5131BD40597EAF85DB3086BA2318C3D9975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796382, "uuid": "8ad8175a-b664-4833-a37a-e95b888cbdf1", "value": "3072:kYKrCdozvZa5pXa/yyiUX+LsDb3ZQeaz/PeFm+nZ7P63No1Bp9I9dysWxzo9Iyik:M4LwbrFmUZ7Sd6Le9AO9E4SAg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796382, "uuid": "470cb35e-dfa5-49e1-a51b-6a11c4edbe20", "value": 278732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796382, "uuid": "59787a27-1b26-46bd-afb3-ec1d660533c3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796382, "uuid": "cc273234-c49e-40cc-842e-cc69b84b67e8", "value": "Agreement_documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ba6f8a-5676-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1638782765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782765, "uuid": "08c574ee-f1b0-4211-a7f8-bc358968083c", "comment": "Malware payload (AZORult)", "value": "f0a4c97d6e6eb6b037f208cb88818fd0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782765, "uuid": "c1f2efeb-44ce-4417-a661-419d97ae0585", "comment": "Malware payload (AZORult)", "value": "379d5e76392755c3e8b078e23aeb07d81618de3f040dc89bc9e64223ef01bac8", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782765, "uuid": "ab3cf292-b241-454b-ae09-d34f804ceed9", "comment": "Malware payload (AZORult)", "value": "12dae482ede7a441fc67b53a259462d8fae21d07", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782765, "uuid": "5a945084-5bfd-4d16-acb0-198b698c0ac9", "comment": "Malware payload (AZORult)", "value": "5ed7bc74d5721f8d4f81f5735c3d9ea60e6a03af356f5ed35c6e8a4b1ff234c4ea425689fa279e1feb49257a4fa29c2d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782765, "uuid": "ff1ed7ca-3fd9-4337-9c39-1cd4737cb803", "value": "T1F241CE2117F5170CD3B28A3DFCB7E310D3B2B811F9968FAD0240509458AA211F5B0F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782765, "uuid": "7d9212f5-5003-4dff-8b9d-7c25bf0816e3", "value": "24:8Wek12OUsTjlzC+pKRWmMAtWC+/CWvLIHeTl+uefk4o0aYrabVIJ0wm:8WCm5ecnxgoOraR20w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782765, "uuid": "664648ab-68c7-4384-a646-0b2269b6a12a", "value": 2329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782765, "uuid": "f22fddbf-37a4-4521-8348-361f24cd0a82", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782765, "uuid": "cd55f006-99d1-4f86-8da2-ec7d5d4f1c56", "value": "Image052.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0de8a47-5696-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638796682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796682, "uuid": "e15fa325-7233-4eb7-9b6f-5ee10ffaf06c", "comment": "Malware payload (SnakeKeylogger)", "value": "8a7488fd94463d0845ea2b723b9cc041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796682, "uuid": "5f3002bf-8d03-4b1f-b740-6bbb98ab3108", "comment": "Malware payload (SnakeKeylogger)", "value": "38a5efd415078e5491b2b3f8bf0f4da02942e7dba03ccbff6e509678203e6899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796682, "uuid": "db95c3c4-4beb-4b19-8f3e-058981682f8a", "comment": "Malware payload (SnakeKeylogger)", "value": "a8f5127a55ff879404c602cb63e8ddf7aac5adce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796682, "uuid": "0e862451-0e5c-4be4-b001-eabb0807ae58", "comment": "Malware payload (SnakeKeylogger)", "value": "7c931a1e782ecdca9024c2e31ea924d460b171194ab95f8d92de49095e50d4a76d6b584957ffdfa44eab28fdb3687792", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796682, "uuid": "8b001365-37d0-485f-91d6-454e3a29f23e", "value": "T15D0522053645AE6AEBE534704FE0C5729365AD8D6E4988433AF03FDF35FE18B2D061A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796682, "uuid": "338e9cad-f839-4548-a4ad-641e6689c708", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796682, "uuid": "b73700d4-cabb-4fbf-a5aa-30de8da17ade", "value": "12288:3bw37mKPHIrPhA49uVq9drXI79zR31khAfCybKuA7mxxQbxPdkWseb1w:307ca49Oq9BhAHZA7mxebxPnRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796682, "uuid": "0e01e310-94a2-4f9b-a415-a52829ff7b5d", "value": 848666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796682, "uuid": "ce4c9edb-3e93-44f6-96e5-0071444bd1f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796682, "uuid": "1cdc6c79-3fb0-42fe-9121-929b23ddcf2f", "value": "(S)FS-8018_21_KRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8162a46f-5671-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638780604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "6eb1af8b-a8e5-456d-a1fb-dd159279bdc4", "comment": "Malware payload (Mirai)", "value": "72d2a593bd642f04361b1ca1f9d456c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "e9f28392-5b4a-4680-90b3-9b10c2211c54", "comment": "Malware payload (Mirai)", "value": "39f652c68b2b7672af4151f86b9f6bf8d9d539a2b0612c4d12e40b1b7041ba33", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "aabab5ac-98b1-4599-b90d-e302177e31c1", "comment": "Malware payload (Mirai)", "value": "eb7a9f0e0bbed957d57d217677b36db93ba09ac3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "808eb3e9-95fe-4dac-b2ef-2a745a59d616", "comment": "Malware payload (Mirai)", "value": "0bd56185c0361f624b6afbc933362bd45eef9e4414169993a8ee5ebaabd3c8df33bd5b32662d76fa5c3c8294b314dcfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "2118d2aa-b3c0-459e-8359-9619483c6916", "value": "T156A35C27E162C27BC18753B527CBD9619923B4B90B72324F73D87DA42F218C91E6EB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "f91ae798-6806-43f5-8ccd-8252024a13fc", "value": "3072:1KEXiFxKcLQsUo3zhWArD7U07QjhDDh6IXhDfoHBb:1JKUojhZ/9UhDDh6IXhDfoHBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638780604, "uuid": "063b78d8-3c1b-4ae5-8029-c9c9bdf3d2e4", "value": 104071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638780604, "uuid": "d4dd77a6-833e-4953-abc2-a7efe5e4b755", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "22449f94-629d-4079-8fa4-f648909efa4b", "value": "vvglma", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b937e7a-5680-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638787037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638787037, "uuid": "0e8939c5-2e66-49ef-88ce-ae0624ff254a", "comment": "Malware payload (Heodo)", "value": "2b948e4dbcd8d0726b46245997d66e6e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638787037, "uuid": "5f4a68e0-6bf4-4079-9e9b-e540fa02f6d2", "comment": "Malware payload (Heodo)", "value": "3a33a8d8ff8406f73fb2b4ab7b29cb103f9bc1a5be7528368283f30c510e1f6e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638787037, "uuid": "4ee5d3ff-a905-4f3f-b4ed-35cc42c9559b", "comment": "Malware payload (Heodo)", "value": "8aa2d51405eeb877ccd12e33e0b004f173116e64", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638787037, "uuid": "1d3d267f-397f-4c02-91fd-266cfc9ea3eb", "comment": "Malware payload (Heodo)", "value": "d36433870fd6b29440ac479323b121bf1a303261978b7ab705f72e1461e01232805183c6b69ef9452d8158baad1d18a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638787037, "uuid": "05056fff-56d5-4c77-8a59-c7c6b9f550ca", "value": "T1E6D44A00D601B12BF9D300F685AB92F995385730236554DB92C8AFE9EB356D8BE31B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638787037, "uuid": "8f0fe4f7-77b7-4cae-b8cf-d4120c21e3c7", "value": "12288:MFAFMb7rizwAdyEDGShVffy/E/pf/0ufbuyn+/RDshf4GbOXX:MFpGzwCDD/Lff9f5/nphf4GbOXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638787037, "uuid": "cbd3bbb9-46c6-4751-bf12-f485acf7c129", "value": 614866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638787037, "uuid": "dbe14027-dc6d-45b7-98e3-c5bfb8162fe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638787037, "uuid": "53071d8e-720d-4896-aaba-c29c17e37abc", "value": "emotet_exe_e5_3a33a8d8ff8406f73fb2b4ab7b29cb103f9bc1a5be7528368283f30c510e1f6e_2021-12-06__103710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadd80ff-567a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638784646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784646, "uuid": "efabe263-2d06-46ae-bcab-7218dbe7a831", "comment": "Malware payload (Formbook)", "value": "9bf35320a3421705fccf45a72e7a9d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784646, "uuid": "61e7e6ec-9ad5-4a68-bf7f-2c2a0ed79ed4", "comment": "Malware payload (Formbook)", "value": "3ab6dd711920ef5111ca693d7332cd49207bd5a174f59139c5abe21db403a2d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784646, "uuid": "5a8e9ace-9abe-44d8-b744-758de1cf4b10", "comment": "Malware payload (Formbook)", "value": "a99e7441704cb2dd650ce15abd82a86b290ac46b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784646, "uuid": "af3786ce-47b8-46ef-9b97-34323a78ee96", "comment": "Malware payload (Formbook)", "value": "c686fa56c90fb4f43a534edc9c91463bd5148b8d852f8cde3f917c56c8555faf91bff7a805835d0e8c662a6c39486c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784646, "uuid": "cec77661-c6c1-412f-8c1a-fa1eb786b0b6", "value": "T1A9555A5C317024AFE83A853149540F3B9EF12C7E966B53CE731734AB8ABD5468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784646, "uuid": "91227bd6-39a2-4dcb-99b5-059c6e0a4769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784646, "uuid": "e117f844-b257-4329-9e2b-310042f3d857", "value": "24576:SBL6IXTk+zhocubFQayL0QjqvqMFGPMQCFLmQNZc5SLaX:ALVg+znuGxqCMY9AzNZkSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638784646, "uuid": "bfe086e4-f839-41ea-b0be-fdd44febf2e5", "value": 1313280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638784646, "uuid": "56f7eea0-dbab-41f7-91d5-15e64a935e6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784646, "uuid": "42696dc1-8589-4fd6-b7f1-7fc0cf090894", "value": "THQT-ANOVA TRADE-QUEENA.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67603caa-56de-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638827375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827375, "uuid": "228e066f-cf2b-4e82-9d8d-a685acb39cc0", "comment": "Malware payload (Mirai)", "value": "67843b740587057aa26422fb540f61b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827375, "uuid": "629fc990-c8e5-47e1-9e4b-a5bfd1ad461a", "comment": "Malware payload (Mirai)", "value": "3b76b0fe0c4336778bcca404f82f3994e4f8e20c4b0cf168bf62bcaf3f9938c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827375, "uuid": "1a7318b7-ed90-4478-85b9-75b8c8cfa5f9", "comment": "Malware payload (Mirai)", "value": "689c63dc82f426b329c222837c56a99ec08c7be9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827375, "uuid": "51a2247e-d0f3-492c-bca7-dcc50b200829", "comment": "Malware payload (Mirai)", "value": "769268053be579f5c6a32efcf350790fa4028bd07a85ffceb0234873581843d35ca5a6bf7641fc3850efba836defd94d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827375, "uuid": "e19e9bd2-12c0-484b-aeea-8c0514122d40", "value": "T123E2E14FDD88DD8CC9ACE57E8C8613B16F55D0E2315E8B2A63068948BB26507F1590FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827375, "uuid": "0c993a72-d16d-4586-b3c3-eefa15af37c7", "value": "768:4rRKG+yWmYI00KF2fWKJ7vmeXT0Gj9FSJ6CLxRqW9:4EGfbH00KFcJ7vmeXTV+6CLxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638827375, "uuid": "2a17a332-9819-4279-aed5-b523127a082d", "value": 33980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638827375, "uuid": "fe4ab7d7-79db-4ad9-b8d8-223c3ff144a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827375, "uuid": "de47ade4-ba8d-4401-96ad-e2ebf0d7d4d8", "value": "67843b740587057aa26422fb540f61b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9242f2-568a-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1638791491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791491, "uuid": "e6de9801-d6e6-47ec-9da0-84882e1c853c", "comment": "Malware payload (OskiStealer)", "value": "a989e8f8982eb3edd6684d790b22e48e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791491, "uuid": "7844c110-befe-4edd-87c4-76e955748ea4", "comment": "Malware payload (OskiStealer)", "value": "3d67ced8c8394bdc10e76835caea07dee4729e86bc665a970b6e1b5af6c33eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791491, "uuid": "0d4d5f56-8fb2-445c-8cf8-9d3262a1e2b9", "comment": "Malware payload (OskiStealer)", "value": "d9c024d4b196a282c7748f3c3e592d8248d71d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791491, "uuid": "b07869b3-0fe9-4db7-827b-9af5bb012d70", "comment": "Malware payload (OskiStealer)", "value": "6f5f751d9c9972254b8e238437f50dc50bdae1873cfb2852dd25453d304297bb3a06ccaf3f7baf804d88766ad896887f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791491, "uuid": "e3cdf574-390a-45e5-ba05-9505a7a25e87", "value": "T166555A5C317024AFE83A853149541F7B9EF12C3D966B53CE731730AB8ABD9468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791491, "uuid": "ccb40447-e5c2-4f5b-a399-25330c9b613c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791491, "uuid": "6a798283-8085-4118-a4ea-2aef6361a199", "value": "24576:4pEZs+LYr8MBLxQuhGlWut2GEAec6216V5vS/aEe+OUrjdH:4e9LYjLPG8u96DV5Y/Rj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791491, "uuid": "7732be43-d679-4c06-b23d-ed881dac6df6", "value": 1367552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791491, "uuid": "f95b5255-67f8-4428-888b-b593d4f1161b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791491, "uuid": "a61c80b5-3d06-418b-9316-b7e1cdf86bb6", "value": "a989e8f8982eb3edd6684d790b22e48e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2992ea5e-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638772296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772296, "uuid": "c57ed704-78b2-41d0-abdf-59b85b362bf6", "comment": "Malware payload", "value": "ad3fab73c1ab5afff6e8430d25fb5d63", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772296, "uuid": "cad91a34-c0fb-41c1-aae8-d21f6ea03635", "comment": "Malware payload", "value": "3ddb0bc2bef7ca7db834ef5d2774cddb6f92c09a3a186ab985f50073f57b71f6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772296, "uuid": "6b8d2324-0021-4bf5-821f-cf285c63254d", "comment": "Malware payload", "value": "0842102a0639b2f777d8da195686502a9eceda94", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772296, "uuid": "6205cce1-01cd-46cc-a1b3-29c73c97fcbe", "comment": "Malware payload", "value": "a361cbb47429db4029d7a81da81642203b3611114553079ad1800a73015cccc30c6d5e6726a566f32c4b3e60d2267a13", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772296, "uuid": "9300bbfc-8eb8-42a7-801e-2d9781eb1a85", "value": "T102342396B766F44DF5AA1C7338A3A652C188CE380F146A8F44C1BC9F4B3D7526C222E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772296, "uuid": "e7a123bb-b812-4e32-98fa-0b63e9c09e1f", "value": "6144:jCxJpYWUCysiLaIanadEciR9bug9122C9grTO:W1ysja52bz91LC26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772296, "uuid": "274f50ca-3c9d-4996-a230-c96b11b8c3c8", "value": 234776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772296, "uuid": "05b6b72b-86c7-44fc-abd6-96f25386ee08", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772296, "uuid": "0153f04b-5244-4140-a22b-eb9d81291d6f", "value": "PO-P18620782 2020013.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05614ca9-5697-11ec-96a4-42010a9c0029", "comment": "Malware payload (BlackShades)", "timestamp": 1638796717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796717, "uuid": "530068b6-f9c7-4603-abc2-2906f921a195", "comment": "Malware payload (BlackShades)", "value": "7884c401d22b144521a876fd90e285a8", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796717, "uuid": "f5de37b0-d4db-4202-8e02-3b156b98c205", "comment": "Malware payload (BlackShades)", "value": "3e2e6a3336af7bb65f3d07a529cc3b4503a0b463bcc3648d6066c1abed430111", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796717, "uuid": "58a044fc-a96d-4f81-be21-898164254ac4", "comment": "Malware payload (BlackShades)", "value": "2dbfa08f37e6520bce1ec178728bffa80b09a006", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796717, "uuid": "9876f617-a33f-4e42-9282-c3d4f6556c7f", "comment": "Malware payload (BlackShades)", "value": "9eda6d23649831a81a883c319a9eba822f92dea91783b130e23e4999115324bce2bbae7cf574dd224e475fae6e553bc0", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796717, "uuid": "c3095a1a-e75b-4829-934f-b4b27ef980ff", "value": "T197D4AE216298EFA4F83EE7B41870744403F9BED5F611F48EFC9870D545B3B805A61EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796717, "uuid": "382f3c6e-72b3-4ac0-9dfb-775b4bb25a30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796717, "uuid": "67e7ab90-3e55-4864-b11d-321a2d741119", "value": "12288:q7WXrmLjED0ZUhNzqL2dirWDLtzk+hdWZZBH9gIqSw:OWCEDmUhNzqCs+hYZn9gIqSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796717, "uuid": "5841688a-2fdb-4668-b2e6-1ad03b6c5504", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796717, "uuid": "7c150a82-b639-4cf2-ae03-1dffdee7cc9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796717, "uuid": "2ac023c7-0d11-473b-9004-cc98c86ace70", "value": "Outstanding Secured Credit Invoices.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd06b80d-56ae-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638807011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807011, "uuid": "62a82d46-7e5f-45fb-9644-de566755f327", "comment": "Malware payload (Mirai)", "value": "a8b15b768020093437bcc846f3a23fd5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807011, "uuid": "d1b58ace-ea32-4911-b579-d5b6c86efb80", "comment": "Malware payload (Mirai)", "value": "3efb12f621ddfa93162ba24cef00bf0b399f1245d4734b9c87abbcdd96f0ffa9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807011, "uuid": "ac38240e-dcb5-4a0d-9741-0903c9a6c939", "comment": "Malware payload (Mirai)", "value": "9ac5cb37b4917bc5ec54726758f2473256db6cf3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807011, "uuid": "a3552db1-cc7d-4274-9031-2443d3b38479", "comment": "Malware payload (Mirai)", "value": "74b9b78572b4b00f91b087b695e90b689f9c37526492b530fe5f6df31f08c8e4be4ad98ebfcf0cc35df9126382eb681a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807011, "uuid": "5cb3cb3a-db22-4179-b5cd-4e41011083f3", "value": "T115D22C03A9418CBCC859C33147BEE92EF9A3B07C1236FA593B947E23EC5EE011E69155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807011, "uuid": "746aba72-08dc-4a84-97ca-919db6d5f678", "value": "768:vfd0+ST1xiPv37DGJieGWWD7lgACC3eTBn:n1kxiX7DG7bW+ACC3eTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638807011, "uuid": "73246d7b-7b19-454c-acf1-bf8411a529b8", "value": 30112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638807011, "uuid": "4626a43b-3052-43d6-9c27-595b0d3ba7bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807011, "uuid": "10801468-ffa9-4936-a9fa-6c68f86b5073", "value": "la.bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc4a9eb-56a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803230, "uuid": "7bdab174-40bc-46df-a284-2baa455232ac", "comment": "Malware payload (Dridex)", "value": "db5ab7750ed5635003b83bd8017b11ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803230, "uuid": "6bd90669-6936-4af3-a0bd-0350a8e26265", "comment": "Malware payload (Dridex)", "value": "3fd7dc1106c94fad9f86c8e3eb4eb838960bfa555de90ee6571f067619f4aa10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803230, "uuid": "2a9a06b4-bb23-499e-916b-04ff5ed1e05f", "comment": "Malware payload (Dridex)", "value": "f93d3037e41d30cadc85f63a5498f4d1f920eca5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803230, "uuid": "78294b43-a8e3-4d75-9c24-e0ce21c6f536", "comment": "Malware payload (Dridex)", "value": "2455492dbba1b0b88387c1e1a68216fbb4899ad5a4fb97f6b574b9b601030e9a96b95387c40ae3c282c81c6050e14fcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803230, "uuid": "0f315464-9bee-4429-8b51-23bcece86072", "value": "T1B9A49F6CFCEBB436C411C7F0987793990D352619E2FFE6E0362B9087A75A6600A4589F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803230, "uuid": "84236513-9822-4552-9700-797e750df33a", "value": "5293be9dcc3fe4423188dd90c7dd2d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803230, "uuid": "b2f6c85e-4d8e-4fdc-89d9-8f4b037074a8", "value": "12288:IQG80io88EmEkECG2EGoyEW+DBY49h4oJIH7l3:hG80io88EmEkECG2EGoyEW++HKyl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803230, "uuid": "f1d22925-8b8e-4b51-bb3c-cce666942551", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803230, "uuid": "b3987981-53d5-470b-96ba-ee004bef0152", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803230, "uuid": "89eef20b-5245-47c2-9b21-8b1e58bd429e", "value": "db5ab7750ed5635003b83bd8017b11ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b544316a-56cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638820205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820205, "uuid": "40a44cc9-4f39-453e-8586-854696b128a4", "comment": "Malware payload (Mirai)", "value": "b645a8e3e118e87c62a041e3e5c11352", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820205, "uuid": "f30b2a29-b7a7-4ca8-bfd0-598a8a49116d", "comment": "Malware payload (Mirai)", "value": "408e2fb36e335cf5d9dad47bf66657a750128c2db4eec878fc0675fb09300a52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820205, "uuid": "3521bddc-de2c-49df-b0e4-14803ee77f87", "comment": "Malware payload (Mirai)", "value": "6391f7cf9031f0830b4633fbb2111c1f2a2c9d77", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820205, "uuid": "113bb174-adc6-4f22-ab17-a0737b48d52e", "comment": "Malware payload (Mirai)", "value": "09f4510792ae06885a1f50a81c0100addce4df8bb186fbfdf473189dc4b03d3a320a56fb8a9f453fa98c9ec7bbfd897b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820205, "uuid": "f4d4b1da-628c-4df9-84e4-008c96bd6dad", "value": "T1F633F115C6DF4811CA702D73D6FE9245552FA7BCC492B68242ECA8A06EEB4DF7278203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820205, "uuid": "1a2b90d1-9688-4a30-8917-e45c5e73c5f1", "value": "1536:hAPtoKBLM7wUJSZsdDILBr1/t4iBkvuOPi+:hAPtcaLXV4iBkp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638820205, "uuid": "39484291-57cf-4bfc-ad0a-e291100a17ac", "value": 54080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638820205, "uuid": "c8a45d5f-7422-4269-8726-925a0ef691c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820205, "uuid": "b7c6e4f9-33bf-430c-bb11-69f4b1a473e1", "value": "trynagetmybinsufucker98575.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f9aeb2-5689-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638790896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790896, "uuid": "c75f1b9b-037c-4522-9842-d90c1605097f", "comment": "Malware payload (Loki)", "value": "a01865e278ece5ffab1a0e6849d3e8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790896, "uuid": "861cbd4b-0634-43d6-88a8-f22a16a7375a", "comment": "Malware payload (Loki)", "value": "40ff5e22f928f47defb8c81c6c141103cdbf82d3faa6ff136f8d88c969b38dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790896, "uuid": "6f7be9cb-2080-4953-819c-0a29a9a36451", "comment": "Malware payload (Loki)", "value": "d85fcdb7b83eec227b4d655a3cbd106f7f386602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790896, "uuid": "d106323d-0f54-4de0-93af-e5caaad61d07", "comment": "Malware payload (Loki)", "value": "a5f24fa04f75757f30d3e9d55f589ee5604d8bf65b65c3ecbc0dde2d3e2da3a459b6d36b1b4c9cfc29dd3de9799fa222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790896, "uuid": "874f186a-7291-4c68-a98d-b3afe6ff5d2d", "value": "T10645691C25B5096BE97D1A30142147778EF2AC3D99BBE3CD3788355B0BB36840A267ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790896, "uuid": "5f7cce30-b36b-4f9a-8711-4afcefa77c47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790896, "uuid": "089bf4f6-2f43-4ace-ab31-6fae672b9ca6", "value": "24576:G1hHGIcwLXKs2pEJ7+FCQOocZD8LvWnSaGLy:aVDKnER+F1LWlGLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790896, "uuid": "9acbc058-376b-4296-a08f-d18d8f934d9c", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790896, "uuid": "c82c2c18-6fd8-4683-9051-47196eade94d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790896, "uuid": "275dc0ed-d0db-4df4-9247-36c08af5c1e6", "value": "EC0877867457.SCR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebf873a-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638775258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775258, "uuid": "b384a1fc-3d9a-4ce0-b51e-6a282cced727", "comment": "Malware payload (GuLoader)", "value": "6dfddc39f73227d50cf184e704a26a97", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775258, "uuid": "3f2ff156-bdc0-4035-8aad-e04baafb86c0", "comment": "Malware payload (GuLoader)", "value": "4360ca67f6b0a71315fc76a1e5fe00f128cf7a26d119b59be292f7c08698aef0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775258, "uuid": "8f23e7de-3084-4aed-a46f-1aae8527a9be", "comment": "Malware payload (GuLoader)", "value": "575aee5f518defa627ec4945202c1e7ddbe9fade", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775258, "uuid": "0a1ec968-f1f2-414d-9dba-a9c09826729b", "comment": "Malware payload (GuLoader)", "value": "acf8f0d47d8fdae7b8cdbeeaac6b40b4de4fa94bc2afeeb524f373bd5ffcf32aff0905a0972ee6f8c976040bb816cbdb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775258, "uuid": "c5ad4006-2c09-4f01-bbef-578cf0dea648", "value": "T1E13412ABB0B58C95DDBF3D3D4D19D26A93B5EC94C43EFA0A0821388F89389463B70557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775258, "uuid": "39fc8f9d-d23f-4bc9-9627-6798eac84b49", "value": "6144:pAhYLV/eB/0If8LGtgf3G4qScwLdN8IkAXdgotVCSNP:pAeV2B0IfsGtg/1JoeqoDCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775258, "uuid": "1bb3b386-bc80-4f42-a4b3-05b686d9ce87", "value": 234760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775258, "uuid": "e1cc4505-2c4f-4d27-95fa-86a32131274e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775258, "uuid": "67f8acc3-99f4-498d-8f62-bcd14987d9be", "value": "Inquiry SC-ORDERTWPO20211206.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72aec2b5-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638765117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765117, "uuid": "fb5f1e51-f931-4d8e-a5cf-6403f7cd60a1", "comment": "Malware payload (Formbook)", "value": "6ad9a14c81a84739baa84d77ef4bd883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765117, "uuid": "a057b2dc-e6c1-4eee-a254-33202ce3c932", "comment": "Malware payload (Formbook)", "value": "43b124c327a2be5af3e68915876795689ed778cfa0d5421d98963e4c51de193a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765117, "uuid": "c2ca72bb-7768-4b55-9dc9-1b62db831363", "comment": "Malware payload (Formbook)", "value": "d48ce5ee5fe8884bd15db0c7ab89835a4bf4bb42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765117, "uuid": "0d268886-9d2c-40a3-a1fe-eb2b27b9af6c", "comment": "Malware payload (Formbook)", "value": "22c8308e6f23b0c8a060a2262fb45c49a2e19adfb7267335db8b2f53d6d41e7823c6121e29a641c12538a1faa0e7ac29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765117, "uuid": "0ea67b6a-f5ac-4590-b514-bac2ac1b089b", "value": "T15255791C25B5096BE97C1A340425077B4EF26C3D9977E3CD3B88356B4BB36840A267EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765117, "uuid": "f3b2c0e6-3336-4ce7-bf7d-445818430e0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765117, "uuid": "d3547f45-867f-43fe-ae76-cca94f2bc54c", "value": "24576:wKcLlKRUQLQME79YeYvBqpIbFYktg3gkOgLl:TRLQn9YYpI6ktg3gkOgLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765117, "uuid": "fd17f05e-904f-49b6-a136-44cbe5f1db79", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765117, "uuid": "4f5013c8-b47b-4159-ba1f-ea5efcec7d29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765117, "uuid": "34e94022-ab6e-436a-9b46-241774a6bf4d", "value": "SecuriteInfo.com.PWS-FCUF6AD9A14C81A8.71.28150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911514ee-56c1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638814990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814990, "uuid": "ba38aa02-e3d1-4a13-8e5a-7a3ad2fd1de7", "comment": "Malware payload (Dridex)", "value": "18606255fd540890ad9058a6d1a6c1e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814990, "uuid": "c9c40362-4735-4b8f-9408-bee49f4129f2", "comment": "Malware payload (Dridex)", "value": "440b905205a4cbd2004e99f8ead394b6dfbf2c840abc6b390a7bc4eccb0ccfd3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814990, "uuid": "abdc5f49-da15-4250-a61d-43a61ad855b8", "comment": "Malware payload (Dridex)", "value": "27200d04f93e540c047e2566a2f28c8ec32dfdb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814990, "uuid": "5c8186d3-f1e5-4a9f-a93f-2a0b14248a31", "comment": "Malware payload (Dridex)", "value": "239a7cb221790da9ee3691ee09d09facaad0db6f9b54604b56b6ad66c8fbba35795b5e8378a83327329b342cb709a14b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814990, "uuid": "547fc713-b937-4ccf-9f7d-de1498790108", "value": "T1D9B312ADD183F171E0AE58B9C20F79B1896BB062E241F0331005F98C5B53915FA9EEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814990, "uuid": "365a1cd0-b6b3-47be-a705-f1517d302988", "value": "3072:H43A+be5Bj1td/fKxSKREvpER3yPpIMoMG64zp2YdFM:YxbeXNCQBI3TMoMuF2Yd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638814990, "uuid": "f00a9dbd-932a-483b-8c58-f02a15bb6bf0", "value": 110984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638814990, "uuid": "aaee4ab1-4298-42ec-8969-c68f4779efa9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814990, "uuid": "dd50837c-51bc-4976-be87-fc59e69ca503", "value": "act advances-8501214944.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96d0dbf-5696-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638796697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796697, "uuid": "1ddddd51-3ade-4c7b-af42-4a7addb53919", "comment": "Malware payload (AgentTesla)", "value": "5b8cb179121c5368b047f20e44ff2a87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796697, "uuid": "fa1460bb-39ff-4673-82d5-edd5501046b3", "comment": "Malware payload (AgentTesla)", "value": "4454c48784f9055c128dcd71d1b595f859a709a08f0bb94f37fb04f60e05d514", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796697, "uuid": "9d5d5fc7-c83d-4b12-8756-9b3af143cd2a", "comment": "Malware payload (AgentTesla)", "value": "01b047468d2d37dcbf3cd2b4b18d0b003b9f9a22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796697, "uuid": "a8dc6503-475e-4ae1-8055-21c9e36c2941", "comment": "Malware payload (AgentTesla)", "value": "55564aa2106411261a62eed834ecdae059bc2684ea9b150639cd036a42b70d6c7bbca8e884ab0ff9bd5bb05303d88d65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796697, "uuid": "5d0a8296-cd5f-4939-a0b9-42a61e3aee81", "value": "T18435421468ABA01DF0629AF11DC4F6F6BDE9F6B6118970BA67500F339712C85CC7363A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796697, "uuid": "2c601aaf-a1c7-41d9-8d8d-8dc17ae8af64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796697, "uuid": "ae6c83f7-221c-4786-82b7-375113e1e4dc", "value": "6144:E0rnl0T9eCpugn/ASVS00oyXiIfToLFoMMvenARy838vj5qHA9eiZrczdKFQ2/j8:MXASQ9XH7U838vj5qg9pcze/bzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796697, "uuid": "2b2f2023-f889-4db5-b017-724a56fab9bd", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796697, "uuid": "cac72081-5f2e-4afc-a203-23707ce6a3f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796697, "uuid": "e4c0f25b-a574-480d-84e5-0433f76095d9", "value": "Yen\u0130 SAT\u0131NALMA SIPARI\u015eI,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388c9e51-56b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638811405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811405, "uuid": "01168797-48ea-4159-9014-f39bcb721333", "comment": "Malware payload (RedLineStealer)", "value": "3cf598a0b9c3ff89cc0440ac8fc8a680", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811405, "uuid": "50e8359b-5504-4b11-9910-1db5d02d11fe", "comment": "Malware payload (RedLineStealer)", "value": "44960a8d1baf423b05ebe39096d43731f66162c8b85f9fbd1ae611e74923d5eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811405, "uuid": "c2d10f3c-a7b9-43b1-a33e-fe30fc7ff8e6", "comment": "Malware payload (RedLineStealer)", "value": "d7adf82038b9c004faca008a88c5ee40cbaca4b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811405, "uuid": "876e20c5-2e47-4680-9265-996586672dfd", "comment": "Malware payload (RedLineStealer)", "value": "5b0b4a2907f04405e2281536c06768f9518933bec7612968b132175c852487a55ad29a6a34b23d13c6c3b630ec80c073", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811405, "uuid": "3af237a2-1f12-46e1-9558-61945d3b9b4a", "value": "T12C9492C4A696D15396CC2D23AFED78FBD138AC6380C4330696F47B48F48797B85D58A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811405, "uuid": "b69160ea-b36b-40bf-8c73-0e16e769f256", "value": "768:r29xLhcazb4JRze+ct0IkTJVmeJl/14BJ6/IyIV2Jn8xSpLUQgA6KufI75mjXZn8:SkiPmfoHpumJ+DxUpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811405, "uuid": "102b00fc-abd9-437e-99ea-a2b5e212fb66", "value": 444059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811405, "uuid": "afb5c923-2ff1-4baa-91ea-5673b9595769", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811405, "uuid": "38d821eb-2eb2-4d16-ace3-f0c39b7836fa", "value": "DiscordSetup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c5e4f1-5670-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638780371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780371, "uuid": "b400561d-188e-4185-afff-8abe96f9d8f9", "comment": "Malware payload (Loki)", "value": "03540780ecfda1f881050621bdf1cf03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780371, "uuid": "5744d1bc-d53c-4750-bb16-616a4ebc9752", "comment": "Malware payload (Loki)", "value": "44d0cf2a33b1d54e4f78404b7fc2b41f6ea4801aa3cc6650e757c8e6100f18a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780371, "uuid": "1a438b9f-6c56-4809-94fe-dc05a9edd78c", "comment": "Malware payload (Loki)", "value": "95e904093ca8ed51ebb05508f75b1d30b03f20b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780371, "uuid": "85af3b72-a235-4119-9247-55f94284a622", "comment": "Malware payload (Loki)", "value": "5f677baf8ebd16efec0556209206befa245f9f85a680ca3fbd4fa9fb03a468e15bc82bc0e175d187054258bb0408139e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780371, "uuid": "26596742-92e6-45c2-a4f4-b7b14735f6a5", "value": "T19945595C317025AFE83A853149540F379EF12C7D966B93CE7307349B8ABD9868F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780371, "uuid": "3d7b2398-ebff-44ee-a6d8-fbafe487c634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780371, "uuid": "02953958-77a6-485c-8cb1-fac77241b24e", "value": "24576:j9GyRLTCQJIogcccRlVsLL84IxFUKsadichy:j97LOQeogncR3Q84IoMQco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638780371, "uuid": "c412afdc-612e-4f27-a5a0-a4085e255854", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638780371, "uuid": "c443ad9a-2607-4e94-8ec3-174721031e08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780371, "uuid": "bcb0f5a6-c913-4ab1-9a05-6b834a976b11", "value": "New Order Amendment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dacd0cc-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760438, "uuid": "12fe13bd-8738-46d7-8b79-d60de142a5f6", "comment": "Malware payload (CoinMiner)", "value": "5748009f0073ba952cbb581c44530798", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760438, "uuid": "dcc48e86-65ea-414e-bb5e-1dbadd14ea52", "comment": "Malware payload (CoinMiner)", "value": "4535de41278b2d4487e8f51de5851d8623de81e68060fe42d9ecb2cc23c4ed06", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760438, "uuid": "7440ce0d-df15-47c9-a443-e960c7d40811", "comment": "Malware payload (CoinMiner)", "value": "3304676ed8a238bf792a0fa359708861b3bfd42a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760438, "uuid": "d6d5970e-9e35-4182-915f-949ce7c49062", "comment": "Malware payload (CoinMiner)", "value": "8ef8ea33b5289b548edd091501bc33d50cd467f56d3cca6a2519f7e05ec80712689c9ad128086ef6189f54abf0e4e8eb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760438, "uuid": "ae7aa55b-8e0f-41e7-9f72-c206461c270d", "value": "T1DD4633205FA69EFDCAAC823D706F2F1E1BF15B81949494DF53A734DA329AB00046787D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760438, "uuid": "8963ae9b-f74a-48d2-bc2a-98c82feb3fc3", "value": "9bfd2dac39af50555ae9789117b36b66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760438, "uuid": "a40380b7-5116-4ab1-9701-5932f575452c", "value": "49152:nhG7rRjqXz8Cc5psGor99nrunI0CR43tFC4y/4TImNx4Z0UOEOyoqZ1xj0xIB200:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760438, "uuid": "e915b8dc-168f-4cb9-8a9b-a808d9c235b3", "value": 5637120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760438, "uuid": "1839e48a-496e-4e5d-a6a9-1cbbb484f9ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760438, "uuid": "60113c4b-518a-4626-a6fc-bd3c7802b1ce", "value": "SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac74018-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638760433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760433, "uuid": "5e9808a8-d88b-4a55-9843-ac1d55911f3e", "comment": "Malware payload (RedLineStealer)", "value": "40f480638f2e8462929a662217a64c5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760433, "uuid": "07210284-1c6b-475d-8f44-e1839669878b", "comment": "Malware payload (RedLineStealer)", "value": "4602413ecd189f0a449f0ae14ba743d35a1b179bb6d2dc227dec2dd048611f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760433, "uuid": "f18b1ad6-6c38-4503-a10e-984905bd35f3", "comment": "Malware payload (RedLineStealer)", "value": "e72a9399e1ba8d61f26ba9a6e300e92d8bcd656e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760433, "uuid": "a267c46a-ea95-4c47-acda-f27f5e279442", "comment": "Malware payload (RedLineStealer)", "value": "793a5ffa101e38a17143e3693c69e1394ab64bedaf15b39ffb9889ccef15eae2f89f31088b1f1dd45a34a4cd3734250b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760433, "uuid": "9758c08b-c2ab-4248-8794-e35913a6ebbe", "value": "T1D6459EF387D989E6EA500F7032835E1798E01D5FDD9AD3D1E562AC083B485A31A38F5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760433, "uuid": "86be299e-3600-4917-8ff1-7ccb0213a06f", "value": "be56bb127031dc1f44491168714ff9de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760433, "uuid": "bfd12f38-85c4-4336-996c-a1f75d30c5f8", "value": "12288:0N0jKyPslJ8rJ2IPPneu301AIBdvDZdXKZDPp8QdoiRVsT0D8N0R/twg:I7Xv1Vah/do8qYD8NAtwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760433, "uuid": "e8620e9a-1b39-43d4-adc2-ae13dd069850", "value": 1230960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760433, "uuid": "d726b279-1d41-4ce5-acab-54e92f5acfc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760433, "uuid": "8ee7967e-aeb4-4ebe-8a9c-20231848c60a", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23121.14723.23598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36df669b-566d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638778761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778761, "uuid": "d98c3e89-94ea-4384-8eb3-d4db994fe654", "comment": "Malware payload (Heodo)", "value": "d3eb80c7345f925b99828be60131c96f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778761, "uuid": "a1a3d353-92ed-41d7-b1b0-e1914cbde6bd", "comment": "Malware payload (Heodo)", "value": "463d5675c8a48c27066234efc3f019b1084a8ccb881bbdcd047b242ddf2311c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778761, "uuid": "e5ae121c-5994-4ef2-a466-bb837c4f95e5", "comment": "Malware payload (Heodo)", "value": "c0613674f287d3faf5403fe30d2828bb76481bd6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778761, "uuid": "072d77be-9775-446a-a2d3-aa2625d3e5bc", "comment": "Malware payload (Heodo)", "value": "bc5e79ed4eee805a31a835f27f507cd2125a20e38fc37bb2c02272429a4588e773092806ce7f109e35e9131c63783825", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778761, "uuid": "512905c6-478f-4ea8-a820-22200a97296e", "value": "T145945B00E711F12AEAE700FBCABB88AD9569BB14139919CF55C86EE5E7190D43C3361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778761, "uuid": "9123c239-6e19-41cc-9b80-9bf02a6b1acb", "value": "6144:m09MHnGC7LRzxzVZYsuOa31UvQV8yMcSWUMuEpzQDWyGVWHmw2MnvXkhcujdbS:me+n9DJGtOal5V8yMcztuEpzZ4GbOXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778761, "uuid": "55d5dc52-d4e3-4edd-9dc4-5b8ad5ec7fe3", "value": 428079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778761, "uuid": "7ed08bdf-872a-4b9d-9c61-2e646c43964a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778761, "uuid": "e806190d-3c4e-46f0-b417-f7908e71b973", "value": "emotet_exe_e5_463d5675c8a48c27066234efc3f019b1084a8ccb881bbdcd047b242ddf2311c7_2021-12-06__081916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f695a954-56ee-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638834488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638834488, "uuid": "02feab6a-a485-4acd-8e7f-3d5e5c0921a4", "comment": "Malware payload", "value": "15580959113d8bfe16dd4d795b928b46", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638834488, "uuid": "98faa8e5-df35-4128-96a4-ed55b4e68a2f", "comment": "Malware payload", "value": "4712e4958a497e62284d5720bf2e24321afbe45c5d920add0fb4f0a5f9dd87c9", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638834488, "uuid": "a1d108ca-4ab7-4840-87ed-9bd54f046406", "comment": "Malware payload", "value": "324c7b103fe621021d62ef8884063f18bfdd3d57", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638834488, "uuid": "a7f73d57-7306-48c0-a74f-f6c7e89e2407", "comment": "Malware payload", "value": "95ea1f21648b149f3ee7c3949193d84c3da670d2c8b54aae87983deb1b7c93ef4f7af0e716aec172c386e52846ee03e9", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638834488, "uuid": "9c04f797-3303-42ba-b716-13b794ed5407", "value": "T1F107337943EA8EF3BA3CD0FDA64F1565E4ED49AB195672172AD34C4FCE38B009790212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638834488, "uuid": "a624e91e-9ed4-45be-8650-b7ace3188674", "value": "393216:stsNjMnSFc8xAG99K0shxZimUW2dHbhvmlM86yxMqkpMkrGWwJtlcTkQxfh:stVYPZ98xZZV2Bt/s+DZmcTZxfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638834488, "uuid": "85b4b549-8ac9-4bf8-9a14-ae941eebd5cc", "value": 17454203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638834488, "uuid": "be94e754-93ef-4e01-a602-03895c8a183d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638834488, "uuid": "9b4c43a6-5ca3-45b9-8f62-8de66188b8c9", "value": "PASSWORD_IS_324325____Norton-Utilitie.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ce1650-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638776120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776120, "uuid": "1d4f555a-7aec-4e70-a17a-59f0c770b1a9", "comment": "Malware payload (CoinMiner)", "value": "8f1cd8d17b6eeadf9ca7b13354c85a4e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776120, "uuid": "ce907213-9042-464a-96df-2127fba3d1ec", "comment": "Malware payload (CoinMiner)", "value": "475f0a4248b9e80094bde9a2307603df79045bb00c158b8ab77090f686df932c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776120, "uuid": "a17cd008-4f62-4d41-b515-3579d91b8f1c", "comment": "Malware payload (CoinMiner)", "value": "841b4f7b52db4143c763e6c7b68834a1594f03e5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776120, "uuid": "a085a643-faea-4e3a-aa0e-809c1cb29f20", "comment": "Malware payload (CoinMiner)", "value": "1885d8f557d71fcf8e47fdc409b7f57fe8a294b93af200f11da98465acb7ddc787ce127b2678d21aef1e7d32de4a6042", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776120, "uuid": "9df72d27-83ab-49b9-82dd-81034ff800ec", "value": "T1676622FE21543368C41AC5385837ED05B2F6551E0EEADAFD72EA7A903BAF815CA01F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776120, "uuid": "936be469-b042-45c3-8656-fed4e2e7cb13", "value": "889336afd01a952ba79d1e90fb751739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776120, "uuid": "228c7fb5-d128-46f4-b9f2-c0c19864592d", "value": "98304:FAzEtbqjsTd4sr+0asRjExzSbb2T/UfwyFFmdISmB9XmKmB8izf7AbVXOHzPbU5J:CIZqKdBss9Ex4wy33B10zmsvIy0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776120, "uuid": "69c12405-dffb-4e10-8b11-e452c6bc0cc4", "value": 6985728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776120, "uuid": "5beeb864-197d-4f52-adb9-b8fbfd2c64c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776120, "uuid": "e19a9676-70da-47f5-9734-03132f870e64", "value": "8f1cd8d17b6eeadf9ca7b13354c85a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9acdbb-563a-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638757029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638757029, "uuid": "85a532c2-526c-40fe-a90d-bd7c7fce53b4", "comment": "Malware payload (NanoCore)", "value": "ed016b16865e4ef9a67b6e458d47ab9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638757029, "uuid": "ec5f4ec4-f00f-4c24-8c3a-53e5e1a09957", "comment": "Malware payload (NanoCore)", "value": "47b4951dac1deae9dcd6bb2006b40b2c64a66be0919f6e56b6233e7fb8f15a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638757029, "uuid": "f921f78b-f61c-45fb-8c23-f0a3e9ce0a2c", "comment": "Malware payload (NanoCore)", "value": "15917164c9cc57cce1f79c88124747263c34b502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638757029, "uuid": "c62aad1b-b100-443f-996f-8b143d9927d2", "comment": "Malware payload (NanoCore)", "value": "aeab925cebc91a77e9a588eb956b0ea468d621087d39b15f0b3efd8d356c801f8b813a980c2690f3561c2a8e60f192a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638757029, "uuid": "ef7e077e-ae19-464c-b0c8-b9ee23176a7a", "value": "T1E6658A1D21B5096BE97D1A30042147774EF26C3D99BBE3CD3B88356B4BB26844B263ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638757029, "uuid": "ea5423c5-5527-4a72-af64-4a65b6631aeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638757029, "uuid": "f3b116c6-5d5c-4584-ba0b-75fd96afa55d", "value": "24576:9sXLwf3qaZSk/8ycnsELCw/bSrnlnXyIXFB8WNRk+LU:9WI3qujij/0lXVXDO+LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638757029, "uuid": "0c546643-3f99-4a18-99a6-729afb95c62d", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638757029, "uuid": "f5567b87-e26d-4c08-b353-bd9cee80df04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638757029, "uuid": "98309dcb-d535-42cd-b238-234f83348d53", "value": "dhlDocument .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9679784-56a8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638804428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804428, "uuid": "c42afa0e-9715-41a3-abf5-62f01585b112", "comment": "Malware payload (Dridex)", "value": "b0105f4cb8deb73bf813d0881781c2a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804428, "uuid": "28121df7-a793-4c41-ac9e-a9bc499480ea", "comment": "Malware payload (Dridex)", "value": "47ccaacdb3f46f8578825f19d50b5d93d8a0dc57f114fc329ee41c8a6f15b88a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804428, "uuid": "7f4dbcde-f6bd-4199-acd9-f57d0525143f", "comment": "Malware payload (Dridex)", "value": "3781d4a2fd04cfe91f063d064a46d14d9b2150c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804428, "uuid": "e4803cfb-d5ce-4479-95fd-732be2b6bceb", "comment": "Malware payload (Dridex)", "value": "a9eed411d44bc78147024d14b0237ef7b62da14aacd7058623fab7d75692ed4a30197a3806f838574bd230f9e74ec02f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804428, "uuid": "5558aaa9-7ecf-49a9-a952-da4bc466c591", "value": "T1EDA4BF4FEEF690B5FA32F8B174528292E1CA9C752002B7D485616A58FCE4C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804428, "uuid": "5beb80c4-4534-4220-8e63-638717321957", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804428, "uuid": "55dca63a-d3be-42f9-a200-d16c9d6235bb", "value": "12288:TCfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWR7:TCfzehtApz4lzQvzU3H2Jz+BbAt3A1NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638804428, "uuid": "b250cf8c-dea3-4e93-81a5-ffcb1c644df9", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638804428, "uuid": "7cc64a54-10bf-45db-b5cb-070e42bb9f41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804428, "uuid": "6416e322-725b-4536-ba52-db31c3413f73", "value": "b0105f4cb8deb73bf813d0881781c2a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95311bf9-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760451, "uuid": "d56c07c3-ea69-4ebd-8445-2b4b1a9763af", "comment": "Malware payload (CoinMiner)", "value": "7b7cfe46454f0f7a9c046636eb66dda0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760451, "uuid": "8348ec96-16d9-4f1d-8011-8604d47b8ab1", "comment": "Malware payload (CoinMiner)", "value": "47e2b9d18762b81536a9a236a382302f9fcb3114e3723a2e90277b903448b536", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760451, "uuid": "c33a71c6-3c44-4d6c-807b-7cea8a1e64b7", "comment": "Malware payload (CoinMiner)", "value": "9ef56977d9b96e81e42f94ef29b144698685e5d3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760451, "uuid": "6dfb2cb9-bc39-444b-b4a7-5bde5224df0a", "comment": "Malware payload (CoinMiner)", "value": "3ebfffeaa3b9dab0876782a77612798bc6467d0f783f1a3639067706bc2765af12298c8faeb5a62f0c6133ce2d78a37f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760451, "uuid": "8c2ce49a-8460-464b-b29b-dc5f99945508", "value": "T14536CE27B70C525DF944183AA0C2FA01EB0456D5AEFEF1E4DB7BAD873742CE4714A1A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760451, "uuid": "0be8511b-79cf-4e65-9fc8-4dbab94b2d98", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760451, "uuid": "76d0a814-2c38-4f66-a379-690b3cdfa43a", "value": "98304:29fRAjb646h1C9DUCDYU1cMMihUjRWzNa4Cj6QqHXk+HcJi:2955h1CFUBU5Uh4C7qH0aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760451, "uuid": "894db6ac-ecf8-40ba-b85a-3b14964709fd", "value": 5158040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760451, "uuid": "02cb0e22-7839-4b6e-a417-ac3417f018ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760451, "uuid": "5307ccea-13bc-4e62-aadd-b3010ef601ae", "value": "SecuriteInfo.com.Trojan.MulDrop19.10258.32603.24964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9702e3b-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638812078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812078, "uuid": "f245018e-c09d-4009-b07f-9c7e405aa3e1", "comment": "Malware payload (RedLineStealer)", "value": "05c035d55b1755dcd7758b1d022e819d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812078, "uuid": "783a088d-c244-4a46-b36d-3ce4c4fbb17e", "comment": "Malware payload (RedLineStealer)", "value": "47e6e14d657f7e04efa24c01587d9930ddf8fd555bb789006c45556969a18f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812078, "uuid": "e7b1b299-ac64-46c2-ab14-62f159f3d661", "comment": "Malware payload (RedLineStealer)", "value": "faeb67e8006b975b9417e1ba110d35ce6a8fdf38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812078, "uuid": "21f3c6cb-3aa9-439f-ac0c-fc0dfb5de1df", "comment": "Malware payload (RedLineStealer)", "value": "2c0fe8f31b28adde788c730bf8d3b37c08eeffec0e9f1b14787380d7244e1f38cc241e3b4640ce775be2a6817ea75e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812078, "uuid": "b3a6045f-bc45-47cd-a828-02883b5c65d3", "value": "T11AC4126B3409D49DE40D44718D83C58658B0BC205DAB2DB33366BB2F8177662ED3E7EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812078, "uuid": "4ca960c7-9cc4-4574-bfc9-b8dc0647b6ae", "value": "e1ee1a518e95973091e7d5987177af81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812078, "uuid": "28d06bde-c3f6-46c9-be4a-90c0e986151e", "value": "6144:9C6VBiJ2iz/6B+6Wcwve3yuT10z3iuLIOm27WxqTG5OJrxWbi8WHnO+3X:9ZBl2iucwG3nzuLI127WxwG5wYmnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812078, "uuid": "f95c2f91-92ec-4d30-b6dd-4964fe05af1e", "value": 570480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812078, "uuid": "bd584cad-e22b-483d-a318-05d8bd648d6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812078, "uuid": "54a99c71-548f-4166-98fa-a689425ced74", "value": "05c035d55b1755dcd7758b1d022e819d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afdefe4-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638773131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773131, "uuid": "dbb6390e-6773-4421-8e55-ccca67618379", "comment": "Malware payload (Vjw0rm)", "value": "f3e0e9df486696d2592d943365a056cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773131, "uuid": "3dd39bb3-07b3-4f00-868a-0de1319b4495", "comment": "Malware payload (Vjw0rm)", "value": "482434849d109634ed9aea2812cb75ccfd6df4bc3a89a63b9b0ed64f45e8dc2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773131, "uuid": "dd77ef07-ca11-47b8-b4fd-df0fc645d9c9", "comment": "Malware payload (Vjw0rm)", "value": "817d83d4ec876ddaa2b3f81fd9c0ba341e6d9106", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773131, "uuid": "4ce46d60-fd23-470f-8aec-f4c10d9d66d4", "comment": "Malware payload (Vjw0rm)", "value": "a3da57c6ce77b29a023ef72b2c38fe548e24ef20b2ff128a090365f13c9ac5ef472b1baea4195a2afb78c89a61d5508c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773131, "uuid": "d6abb921-a5f4-4c8b-ab41-abaa62969e41", "value": "T15883B3099F901C47B5B4D69300AC4524FE16A2F4DF2AACBAD45149CC0EEFEC76B93E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773131, "uuid": "63d384ec-e901-40f5-b2db-4fc689f55820", "value": "384:GukpJYpuKYHpZdQA7ofWIb2KiQc9vTYajiakwNHOZH0vIJomox3BLkjAhPyakNSu:/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773131, "uuid": "2607f318-a276-4dc4-9183-0910d072043d", "value": 83682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773131, "uuid": "eb224a8a-7d7a-434f-b24e-ce98c177459f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773131, "uuid": "2cf38f18-5074-4129-b6b1-f6b64e46ff8c", "value": "91165342_Payment_Invoice_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92849b63-56b0-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638807691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807691, "uuid": "02ee3104-7de2-4474-af00-6d64dcc4bfc6", "comment": "Malware payload (IcedID)", "value": "54bd3a30361c3a9520af3f2af9b6dbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807691, "uuid": "ec4e76be-4381-44d5-81bd-70a6d6832fa6", "comment": "Malware payload (IcedID)", "value": "4845cfd63638b9ff86c881b76f12763d0439b23a2ba841644381f751d192d346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807691, "uuid": "2ba9c72e-23e3-4188-9675-72e9f8a5dc3d", "comment": "Malware payload (IcedID)", "value": "a11a6345fbcb67c856399d0892fd5a33bef403ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807691, "uuid": "2a7e4901-c0e0-45d4-9d92-edd7fab6b15d", "comment": "Malware payload (IcedID)", "value": "fb8ee132a4dd790fb019f43c33c0480600d277e9372a951696ae358d73828f6a346b05b63d226f0533c0a84ccee20bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807691, "uuid": "f1695aaa-3da6-49ab-8e94-83f95fa09136", "value": "T17E1538AE44CBC59FFEA18838DDA46AE3C293976ECD6AC9F34D8594302C114D9487B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807691, "uuid": "a5d6b927-a612-4220-86a0-be863a9ba21f", "value": "f6bdd1c75556d961afd6fb8104c342ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807691, "uuid": "591bf9c9-3545-441a-b6c0-31a6024658ee", "value": "12288:HfdCRsouYgpzEvqM8dxJ6IO7ByLErvB67sH:HYRx8V6IONyLErvB6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638807691, "uuid": "a6961117-4586-4717-ab3f-7228370d2526", "value": 889473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638807691, "uuid": "e96e0c1c-1301-4919-b897-fa4c3bc7b0f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807691, "uuid": "888134a9-cef5-441c-8b64-83d1da860359", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a0d736-5691-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638794434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794434, "uuid": "7fb75846-caeb-4cf6-8f7a-7cf34e82e02c", "comment": "Malware payload", "value": "4dadc2245fc209e51d9c22753f5a8eec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794434, "uuid": "4a865ed7-8638-4d63-92de-96f0a07708f4", "comment": "Malware payload", "value": "488bf0c238bc463b44031393d299f8959b277b45ac18a09d82f5d1557223ef70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794434, "uuid": "7f80eb3e-d2e3-449f-9d7e-e0397880b2d8", "comment": "Malware payload", "value": "2e32247294f43fac2edcdd1d044c70b398e03905", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794434, "uuid": "6033353b-18af-4375-8ad2-e7bb9f06594f", "comment": "Malware payload", "value": "4b4355d7f9c85ac0eef172c8e239f8f75728e504ad4714a29d309caec060f13c9b825842895ab12a916c02917d09d803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794434, "uuid": "433390b5-d61c-43d0-a8d0-00d045410db2", "value": "T13AC633991599C73FEBB0387DB1376FA2EFF67C02AB388618179039881CB25169915F34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794434, "uuid": "dc563a80-529a-49c6-9637-96435a521897", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794434, "uuid": "a36e39d8-d2b3-4849-b4cb-315417ec2b97", "value": "196608:8Qucxpj2Q1QOTR2Xx98YN4cCV7V2qPlAUkT5Nnt8NjLwJ+Dfs:8Qucr20QOAL8YN4cCVE6CUk5GjLwJ+DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638794434, "uuid": "24fc79b5-243e-412c-ac46-c89404ca58c6", "value": 12221440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638794434, "uuid": "00447d10-84eb-45e0-8b8b-e47d74a7722c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794434, "uuid": "82975df3-ebb3-4e3b-91d8-f4727b3a49d8", "value": "4dadc2245fc209e51d9c22753f5a8eec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814bc9f2-5671-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638780604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "6ccd2085-519a-4094-8891-9eb0a275e2e7", "comment": "Malware payload (Mirai)", "value": "6761bc75dadf644e49352a1ec93e2c0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "5135adb8-9cd0-4eb9-bddf-48ebf2b5fbd1", "comment": "Malware payload (Mirai)", "value": "48e1ff2e6af16b4c08eb5cad385c2693678a065ff5af9b0fc46cf8d02747d539", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "bbe08449-1315-42f3-a54d-c6e55f1ecb01", "comment": "Malware payload (Mirai)", "value": "90184d4e2c9f1ba26f02f9b0884c9c4171742745", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "02bc2853-d4f8-4237-9efa-ab2864d87769", "comment": "Malware payload (Mirai)", "value": "76bf446745779514070e39afcba878204db0b4097e3865e6913ae0cdd5db975dbe1c5ef5e372f9a6da6bec997137743f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "fd7151ec-c9e0-49ee-8683-c77ef7599572", "value": "T152B31905F9418717C3D327BAE78E438D3B3557A467DB33116A386EB42BC27992E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "5b47ff78-6b60-4f45-b22e-4b7eccbaef7a", "value": "3072:PfOi3gbmBwHTe4yVh+mef/aS//hDMv+S4DlYsysQK:uIiHTe40oFf/a6DMv+S4DlYsysQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638780604, "uuid": "5242f817-cade-48ff-a174-afcc8ebcec7b", "value": 110690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638780604, "uuid": "2452dda7-967a-4a41-9481-fb046cadbdf2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "a5513961-af33-480f-a5d6-f4b1daa99daf", "value": "qtmzbn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a102ad4-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638765103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765103, "uuid": "a1025928-713a-4d24-afbd-adb26b70d402", "comment": "Malware payload", "value": "94228e1e0e5d741d9c11b036278dd7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765103, "uuid": "0b24eab7-c4be-494e-a6b4-80707fb25b6e", "comment": "Malware payload", "value": "4994ffb706a3a3688680f18c7324ab6813a19688e2141b5ed3ceb214d04210d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765103, "uuid": "20e26b07-4ff7-4252-bbdf-1bedbb37ae91", "comment": "Malware payload", "value": "bfc9f151cc46c07752442ca96350e8b523822b31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765103, "uuid": "cc07a48c-e735-43c3-9863-29d96a02b86c", "comment": "Malware payload", "value": "e3d6e21b0bc8cbe670ad8efb5299c51d0c60d28cc18b5c95b8c8b428c7e292912a1f399593749cfdcb6e824da0c9edf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765103, "uuid": "ba71af80-00ab-40e5-8196-1b30110d1742", "value": "T176163382F1D0DAA6EFF7AC329870AE740BB5D9B07826CB6A5408FD5C1E331065973947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765103, "uuid": "02ba1921-02b9-44f5-8775-c3aa7d032142", "value": "98304:s5mk2WDnZWewRAx1h6+lWzRbci3PLd22tCBhKr9oLkT2v:0lFWN8lWzhc6hhCB1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765103, "uuid": "26bf6b20-29f1-49e1-9a69-566756946646", "value": 4276224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765103, "uuid": "ad6cf51b-2bf0-4e28-a355-a61b9d4e428a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765103, "uuid": "a60a8995-2b55-480f-896b-78b544f2060f", "value": "SecuriteInfo.com.generic.ml.6946.24457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8a368f-5685-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638789107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789107, "uuid": "a1c31582-f47b-408b-a895-1f932ef6d5ad", "comment": "Malware payload (Mirai)", "value": "bd5de148d97aa2157dcf8d2899504536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789107, "uuid": "c86dbf90-d6d3-4d52-a178-9554b839fe6a", "comment": "Malware payload (Mirai)", "value": "49e0089c2760f84ab0ef4ad0e8cc1df3996ed2f6afdf5d1b97bac4d66b35901a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789107, "uuid": "da653058-60f0-4614-8bff-b3b16bcf23c2", "comment": "Malware payload (Mirai)", "value": "55a2176f065bc25a6f1506481551c08ee2844e0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789107, "uuid": "98200784-8179-4c08-9045-b87a0b2a3479", "comment": "Malware payload (Mirai)", "value": "1beaee1573b323b901431204cfe9424f6b56045ae796f8a97e51167e8ff30768c96a154c531b3dc70cd2a78bb9d0dab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789107, "uuid": "4eed5940-af8d-4152-9f0a-844c1e7f95c0", "value": "T163D2F1D8D1457075E92C837B540E6AF52263B8028BD94F2931F0F4DA6F93211B46DBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789107, "uuid": "6533c56c-748d-4154-933f-5ef86d025435", "value": "768:yokg7wCO+rRwsGXcVz35tU0mRm2z5hOam7BFi:XUCdrv4cR5tsRmoG17K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789107, "uuid": "3b693279-3d74-43f9-a5c4-ee10c6b66017", "value": 29636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789107, "uuid": "d2f70ade-7c70-4f1b-86c4-449d204d7cf8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789107, "uuid": "a6b15c4c-aa37-4007-b569-851f6bc88148", "value": "49e0089c2760f84ab0ef4ad0e8cc1df3996ed2f6afdf5d1b97bac4d66b35901a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff13b8b-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1638808841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808841, "uuid": "9e562337-d5d5-4659-bfc5-14f9098d0e61", "comment": "Malware payload (Quakbot)", "value": "5d8267f1256be160b605d7aa0eceee94", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808841, "uuid": "9c1a410c-4fcf-4b74-b507-2e0c88a19dfa", "comment": "Malware payload (Quakbot)", "value": "4a3a5d72293fe53170b1ff2b4d1d8701e3032d8bd6d16ea4794b704f6edd2140", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808841, "uuid": "f4f4d86c-9a2f-4567-9ad0-2fa3acb29b24", "comment": "Malware payload (Quakbot)", "value": "0c854de67d9eee533c119bc2c9ef2334ac6dd977", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808841, "uuid": "673c17cf-1290-427a-b0c1-9897798ee760", "comment": "Malware payload (Quakbot)", "value": "1a895ba5e1a30dac65df6e0c896bd8d3d0748dbcf0014059c3b8a71e26d0b235f256b5497f62a1b2bfaf3cd3efe434e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808841, "uuid": "9b71142f-14ce-4ff6-a8e4-24d7d25460c6", "value": "T1245302E7D9321594B81740368CF089D7AAA01F942BAED2C3F5CEF272582905D53E17EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808841, "uuid": "e28b7a53-b27f-470f-9e0f-8e8c91e66383", "value": "1536:Cp5HWvqxfvZ/ChUsbvmKER6fvjF+Nzdp50RQ:Sxxfv8OsEQFMzS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638808841, "uuid": "861c8882-44b5-4136-82e1-412d3e544611", "value": 62103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638808841, "uuid": "3f197d67-4705-483c-a511-53339e099057", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808841, "uuid": "054661e7-812f-42b4-b88c-27c07b240387", "value": "q-2377536609.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff0c6e0-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (ServHelper)", "timestamp": 1638765140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765140, "uuid": "f568ef5e-1d7f-4c59-9ba4-d41ad3118062", "comment": "Malware payload (ServHelper)", "value": "7faddf1721f8f471bcbbd735e4032e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765140, "uuid": "167355e1-deca-4b6d-9bdc-455d88dfd3c3", "comment": "Malware payload (ServHelper)", "value": "4a6a29e358327ac53ec209cfa4e32d73286413bdeaa2da4c80b8109b7906de5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765140, "uuid": "15c5d688-5150-47bc-a6a5-432b4b9da924", "comment": "Malware payload (ServHelper)", "value": "9e1aadf3e0cd2642365599236e2dd9eaf1ab9aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765140, "uuid": "741d6f48-8e67-4c23-9bcb-8a2983ae8f6c", "comment": "Malware payload (ServHelper)", "value": "6694cbcb34b7728ab8f8474d61cfd8da8a8ec4dd9659941b87021e853bbfa6504f860762b93cd0594d032c1117d3a9fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765140, "uuid": "fb46c2d6-1db7-4e7b-9e3b-61952e661bd0", "value": "T1E026D0C3BCA474B5C9A9C231897992913731B4990B31E7C72F51A6BB2EB37C45E34394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765140, "uuid": "a2ce6df9-3df9-4707-9a5b-d279de4956de", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765140, "uuid": "cc941056-5a3d-46d3-a1fd-1d7a8c2d2da8", "value": "49152:+qf12XPV9tH7TErb/TevO90dL3BmAFd4A64nsfJbWwqCFoq+fXihP6Xr/a1Sm/Fg:3fY7TMZQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765140, "uuid": "aa972045-2b4f-4ee6-9c0c-03757f2d7244", "value": 4803072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765140, "uuid": "e0cab281-437f-4dcf-b0be-a0202c80c146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765140, "uuid": "320449ab-291e-4341-a216-4b6b2765b8cb", "value": "SecuriteInfo.com.Trojan.GenericKD.38168840.9615.25220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc10e0b-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638789750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789750, "uuid": "85a7085c-7063-4155-9723-b6eb33989aea", "comment": "Malware payload (Formbook)", "value": "967c89ec5975f4463d26a0811ba0facc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789750, "uuid": "ebe41b23-064f-47f4-b8b4-d29b50018c6d", "comment": "Malware payload (Formbook)", "value": "4acfd899585cc3b46b0e523ba0cf61e4c78994e4ece49590323f41f8ec4c9eaf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789750, "uuid": "9c17176f-78b8-4927-ad6a-d9e9a15497e5", "comment": "Malware payload (Formbook)", "value": "aec27ed5e87b1ae3dc63cbeb3cdf6bcdd7e08b74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789750, "uuid": "ea14c78b-687d-4e70-8f93-49e357805daa", "comment": "Malware payload (Formbook)", "value": "aade27d1100cd30e4dd46820809911b50a1b5b0cbc525ee6b0771b3993285bf5b88510056845134e171c0a6eda625596", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789750, "uuid": "323ad311-3f07-4ef4-9560-c6792bdf962a", "value": "T11D3412497B34E665C8A9A9B888382871845DDDD37EC1CF49712273DDCBB61FC0924B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789750, "uuid": "631a9d97-6477-4c32-970a-eb137337550c", "value": "6144:5XfW1JG1OPR73gz8YSx9uidTsdlzzpVWU:5XfsV3gz8YSx9vIlfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789750, "uuid": "0059f3da-c8d1-422b-bea4-a2b3797d4cd9", "value": 234840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789750, "uuid": "0c73edab-8a74-470a-9901-ee05e3730460", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789750, "uuid": "bc2c9127-8c64-463f-ab91-196994c21f3f", "value": "Shipping documents Invoice and Packing List, Certificate of Origin.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca9f926-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638776194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776194, "uuid": "8e24e1c3-17b4-40b9-869d-340fff81ac36", "comment": "Malware payload (CoinMiner)", "value": "d5fce595b6cc51ed68e3090b624c716d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776194, "uuid": "d9b787d6-f75b-4b40-bd92-329f6b54a132", "comment": "Malware payload (CoinMiner)", "value": "4b89c6621588d5974b419f6aa7610ac8df584564a52a8555d32e190bc4f089f9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776194, "uuid": "5246e752-1f1d-495f-ae20-87ef50d4bab2", "comment": "Malware payload (CoinMiner)", "value": "49d091f52156fd2f7401026fc923f3d962326ce9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776194, "uuid": "a3bde080-da5b-4621-9b17-87484c92f473", "comment": "Malware payload (CoinMiner)", "value": "4d74a70ba2f8f8b7f9d667dbbe3b8922454e7705b96bf1cf1ed3c8e9adbed23c9216eb12f7408518ff781d7dea301589", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776194, "uuid": "b02a62c9-16ec-4a4d-bff1-c33e2d150580", "value": "T193451A0567AA7F66E03E83394531180953F5F407E336EA6B7FDC64DA1B62F008A53B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776194, "uuid": "10321ad5-cef9-4179-a9f4-4b0bd399905e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776194, "uuid": "665ac8d9-f747-4eb7-8549-75fd5546bfce", "value": "12288:OgmWOI+SKiWkCwK8mek8UULKefzmPL8QdraBWQTrKStC4IE2lmuqZDYAxVkBBP8t:Ox/wp7L3K+2Q4/UpLXrMD7V8Ve6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776194, "uuid": "f0988158-ec01-47f0-b031-ee42e6b177e8", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776194, "uuid": "e379bc16-f0f7-4c79-9067-e463aa43c08e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776194, "uuid": "3786d5eb-96c2-498d-83da-014a70b43329", "value": "d5fce595b6cc51ed68e3090b624c716d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9412d8c0-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638760449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760449, "uuid": "b30b884e-492b-4e41-b6d0-8b202734eeaf", "comment": "Malware payload (RedLineStealer)", "value": "b863582bafa8cf3d912c52aefd8f8b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760449, "uuid": "d08ed0ea-8535-4936-9fd2-783bf8927e69", "comment": "Malware payload (RedLineStealer)", "value": "4bb2e211a3844b88fd193fb121208c3a95c83af1c649f2d654461fcec7441b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760449, "uuid": "0e0fb86a-1f3e-4b84-b6a5-4640f28b13a5", "comment": "Malware payload (RedLineStealer)", "value": "f272e8102fde54145d8da7ad1aa8b51fd6b691ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760449, "uuid": "4ae2c8d4-9d21-4be7-860f-53a626a09f65", "comment": "Malware payload (RedLineStealer)", "value": "119f5b78f9ac23832c2fe1e641386302c7148258cc0bbe7891bc89fc8f9b8a098b5ed06d89a3f46bf3551023758371c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760449, "uuid": "a3337c92-48ac-4ee3-86e5-6280c36cd3bb", "value": "T18C0522B4330D538EFF0E48BFA90E865B1645EC8669C0A17523453E6E3EB3DF04A53A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760449, "uuid": "2a9c8f71-e9bd-4dbd-8403-2d1e42ba2099", "value": "aafb5c49a19a70bbf78d3500670ead61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760449, "uuid": "1f4689fe-891d-478e-8571-3e41b1bf65b6", "value": "24576:1X4a7IYsBRSGhTlBUt4yOGwVnXXZECXn:+a7HeBd9Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760449, "uuid": "609b24df-ae93-406b-9589-00bb31120812", "value": 871648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760449, "uuid": "67b12486-c0eb-4fad-afee-7801ac425c8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760449, "uuid": "8a3651c5-f0cd-4157-9e2f-af45dfb1734e", "value": "SecuriteInfo.com.Variant.Barys.234615.110.30430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea01f40-5635-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638754668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638754668, "uuid": "71026088-c483-4235-b54a-9c1d030d51b7", "comment": "Malware payload (RedLineStealer)", "value": "8208d70d7e305e7f4a5b35d9538d21d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638754668, "uuid": "c45bf478-45c4-4929-a574-8e2e3beeda3e", "comment": "Malware payload (RedLineStealer)", "value": "4ca224ab76f2d9c14aba161ddcf32da6cb84dc40f90cf97d4a6fd7e966300e2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638754668, "uuid": "366d6d72-81bd-427b-a0bf-48d26b034515", "comment": "Malware payload (RedLineStealer)", "value": "6ce23345c8bfac843fb53650e66852887b961f3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638754668, "uuid": "e3175b69-994c-4633-8db4-4a80595109be", "comment": "Malware payload (RedLineStealer)", "value": "efa72186a8c5719b1cc4f3fa4f263aa0c20ae0fa9865053d5eace2ab730a1343929bedbc7c7564bb8ea1252b67852668", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638754668, "uuid": "3c52de40-ae6c-42a2-ade6-5826990f72d0", "value": "T1737533FB12562AC9DA4F14F593DA2B19EE153A2DDCD9B00F6930C0D338B46A7136607E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638754668, "uuid": "f82f89e0-46b2-4d75-8d98-cc59196b53cb", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638754668, "uuid": "15644f1d-6dce-4416-87e2-ce6414456412", "value": "49152:ves9l/WW3K0dhBjkK7p0Ok6O0nD4+U3NaCfj:WCBJF0Okh0D3oTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638754668, "uuid": "99254400-5208-4ef3-a8e5-5a9856fb1cec", "value": 1593208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638754668, "uuid": "23740f0a-20df-4442-9cf6-dba58ea93791", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638754668, "uuid": "8e170a6e-b57f-47f4-aecf-04d1d5ab0e72", "value": "8208d70d7e305e7f4a5b35d9538d21d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad13e3df-569e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638800005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800005, "uuid": "60d42a3d-aaad-47ac-b32d-ef1ef099df8f", "comment": "Malware payload (Dridex)", "value": "0e078fcb83f7689e0a613d1e1f98592d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800005, "uuid": "c54ea5ba-17f2-4d43-9c4b-8a7a3c2c5f32", "comment": "Malware payload (Dridex)", "value": "4cf90ed4044d8025261e4740f1b9a98ed5d2c63d9bd9758257bf0881b2e28aca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800005, "uuid": "53ff49df-0824-40bc-8655-2bb1ce166e55", "comment": "Malware payload (Dridex)", "value": "02c9122c00abce3664344232be0d821647f5438d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800005, "uuid": "70fe59fb-b802-408a-88ad-a6beac90885d", "comment": "Malware payload (Dridex)", "value": "4d2a30293144c85fa69a643b116acf51d8146bfa660a307b9cd127d9ff98b6abcf11dc4edad13b2791e4dd4dd6bec42a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800005, "uuid": "d6402558-8fae-4aa5-86a2-6b4f75a1f40d", "value": "T1D5A4AF469916A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33A2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800005, "uuid": "48d92a8d-4a10-486b-b078-0e6111c15b69", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800005, "uuid": "9b5f0c2b-24f4-4506-ae00-ede9b1c6037e", "value": "12288:m7fimEsIsmY4K08oM1Wd8t5KQhNdv5zf:m7aVRBn7x6jt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800005, "uuid": "ca2f3f6d-c6d5-4f0d-bf9d-810710cf8682", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800005, "uuid": "3085c8a8-06f3-4672-b773-cf6b85701df6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800005, "uuid": "e8a11554-3b10-49f5-9426-970d74edf26b", "value": "sr6waumq1.rar.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b50c28b-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638775413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775413, "uuid": "a9a887de-c1ba-4dfe-94ae-d050e840160c", "comment": "Malware payload (Vjw0rm)", "value": "7af00552a9b9ae64342d289f60c43627", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775413, "uuid": "f453e9a1-84b9-4c1d-9127-897a5efc0abd", "comment": "Malware payload (Vjw0rm)", "value": "4dd51675717f0f703ecbfa8e39c69a3038d2a3a42927a1cb5ab0271d3bfebbb4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775413, "uuid": "0845d503-8700-40f5-b78b-64778a943aef", "comment": "Malware payload (Vjw0rm)", "value": "dae12e7429417f66e4419bfc6cb1b0f1e820c7c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775413, "uuid": "5666ec46-d573-4cbf-b692-888a0f4def65", "comment": "Malware payload (Vjw0rm)", "value": "4b51a2232b4ffcc5d34b4fca56978c9cb8b73580fddf297fe5342452abc447b978d6beef3008e4774f95a8c76384aa7f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775413, "uuid": "1de9a3ee-3abb-4c8f-995f-7b6f2e34cf72", "value": "T10E642DF4BB80A0A788518063F251255882B41325D9B0B6DD357EFB17273DFE4EFAE849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775413, "uuid": "d8bead4b-a50f-459b-94e4-1f89d1550cb6", "value": "1536:yMhzml3+24W6XZ+RPIodXhdyuQ1DGK6BDEyDcd9PagoOsG5fHGrN81QJFTYK5P5E:Lo7byfNPaNff15zQayLSYKfFqThrsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775413, "uuid": "17161b89-8f61-47be-b511-d5e864ea423d", "value": 325195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775413, "uuid": "62482c08-7830-4289-bd6a-c20b7b2f8b2a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775413, "uuid": "fc029375-508f-48df-8b4a-77a954a13b80", "value": "KBH-209294916.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d29a9df-56dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638827009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827009, "uuid": "17f05f51-b0fc-4a05-b592-9b6563b66e64", "comment": "Malware payload (Mirai)", "value": "b515af4acda9e6622af10cba449cf784", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827009, "uuid": "81eb78d0-2cfb-4866-a197-7990ab56af60", "comment": "Malware payload (Mirai)", "value": "4e80aff6fdeb069421f083887a0a891944c74dd0fb612f7a7b63256938fd15bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827009, "uuid": "228f3e6f-0d95-468c-be28-0bf6af8505b7", "comment": "Malware payload (Mirai)", "value": "62952685adfb214f4327d3b2b898970da02ac357", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827009, "uuid": "0bda5b00-6bd6-4b83-a9f6-4cfa30bcec58", "comment": "Malware payload (Mirai)", "value": "a2161958ce0647aa7a34fd727de6a8cefe113df82473cddbc03e63b201511c381037544027f0120ab8af4f570f8ff074", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827009, "uuid": "362b754e-821e-4d75-bc1a-a7e65ddbcd02", "value": "T1C6E2E1147E14EE70E62010377BBCA5CB75195BB5E3B13633AD0414F4A5C2E9D267AB13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827009, "uuid": "72aaf6b4-a329-4f0d-92de-b28493276bba", "value": "768:wJyUNrrzpZVvhIMxMpU6LIJaTq5FW7sAIN0vhjmms3Uozj:EyUNvrVvMed1aNUzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638827009, "uuid": "2fe8f76f-cc19-408c-8238-e33335581f96", "value": 32568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638827009, "uuid": "414558d1-97f5-4eac-a121-43a54ff7fd36", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827009, "uuid": "c230d06a-b837-464c-a159-eea4cc5d5c2e", "value": "b515af4acda9e6622af10cba449cf784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01745b50-5669-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638776953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776953, "uuid": "45b5e3f9-0b2b-4dca-9cfd-4be049964d16", "comment": "Malware payload (RedLineStealer)", "value": "eabb876f62eff390575fdefbf1610b77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776953, "uuid": "df778761-f55a-41ba-836c-a5d1074feb8c", "comment": "Malware payload (RedLineStealer)", "value": "4eac12423a78201d89bf682621b5be5409f9667140f853115ed151c4af89abcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776953, "uuid": "3d69c7bc-472b-4f1a-83ee-57707b8ebaee", "comment": "Malware payload (RedLineStealer)", "value": "77eb326354b51c47c365e6f962ac13927151c931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776953, "uuid": "2098436e-e254-4ef7-b9ea-dc8501631cc9", "comment": "Malware payload (RedLineStealer)", "value": "a68e579e6de65df742e0ee443ddab2d4106926162234f9fb4499b080df68874402c58a7c8851fe3dfa390c00979adb99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776953, "uuid": "6a6d6554-9869-4cc4-9654-aa99d2dbed6e", "value": "T13432F841B7F84A7AD6FD0E3908B397200675E70A8462CE5E2C8C518A2DA37944793FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776953, "uuid": "9b997730-8738-4023-860d-42eb587b13f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776953, "uuid": "44ccf933-81e8-471e-8912-2b3ae66a0e8a", "value": "192:u3bl3S/63ZTNIpW19o72EbpWl3hLV6btZI45JcJ:u3bl3O63ZhZS2EbQlxLkZ57c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776953, "uuid": "2f32dd07-c172-4b96-9ee8-975e68ee5a62", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776953, "uuid": "c813504c-4576-4743-8840-dd9e928df2a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776953, "uuid": "68903709-e577-4cbb-ba0c-22cdc92ba848", "value": "eabb876f62eff390575fdefbf1610b77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779bfeb5-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638782305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782305, "uuid": "cde3b8ec-ef00-4223-9265-986086da6841", "comment": "Malware payload (Loki)", "value": "69e50153619ce219aa8b526cc8c6cb1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782305, "uuid": "8f83b78c-1fce-4e52-ba4b-76d02a33ce6a", "comment": "Malware payload (Loki)", "value": "4f68d7352e104d5eac36c27fd94ebd352aae06cc335f363df2f9de78933ed92d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782305, "uuid": "9432cd7c-0b10-4421-964c-8a6ab281f8eb", "comment": "Malware payload (Loki)", "value": "7a5429ca50ce7d5cc462a0d26127a179259113d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782305, "uuid": "a2298baf-cc87-46f3-8ab8-2dfec5d4d0b9", "comment": "Malware payload (Loki)", "value": "ed87fe157f677f0220eeaee04e11ba9286482a7e603149a2ef4ee8f2cf6517e82ce09e7b4e5c2221b5da6002e10d3ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782305, "uuid": "c471ffe6-e885-4def-8576-bc696880253e", "value": "T19A45591D25B5086BE87D1A34142147378EF26C3D99B7E3CD3788356B0BB26844B267EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782305, "uuid": "2ee1e737-f810-4cdd-8cb1-0cbaacc0cece", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782305, "uuid": "cda3741b-974c-4c7c-b886-8adfccd5d488", "value": "24576:83ICu0pikdDiGmb19In8xr+A5McgMBFiqKvLrFL1:AuulPAIqqA5NrPkvLxL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782305, "uuid": "76439bd0-6c1c-45ce-8438-c2ec54cc5a42", "value": 1210368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782305, "uuid": "d07d2825-1d25-4dec-bd54-278e482d92ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782305, "uuid": "055d3d79-5b12-4f26-b86d-eba6e9ff3737", "value": "DC9095857497494.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59b7d52-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638812152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812152, "uuid": "e2c681aa-5222-452c-97b9-086215ce1f27", "comment": "Malware payload", "value": "fde3f0dc476337ad0d331bd01cd4fc66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812152, "uuid": "3c59ef48-e7bb-4d4b-8c26-cea397f3aefc", "comment": "Malware payload", "value": "502e798c85c1ea21f38b8e29858bc058b6f80a3045039ecaad3e4e32633de632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812152, "uuid": "31d3c3cc-bfdf-4395-b525-002119818bee", "comment": "Malware payload", "value": "4ff82d5c5226e67fe2b6a00b187ee9e29e1a0c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812152, "uuid": "afa59fa4-5619-4b83-970b-a907a06a2f89", "comment": "Malware payload", "value": "a0fc8d24df3a4a584170845a9a23823f28283b2b8eb9dd6bd09b66019773b32c5264e219460ed787f1a26e5930c38af4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812152, "uuid": "f3bf49df-4a46-42b4-94a2-d8a83660829a", "value": "T102D1E891FBB84FB6C9EC0C3A08A3A6100671C30F4552DE572C9D94D679C77981393EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812152, "uuid": "3fd55e23-3c1a-4ffe-b580-7cdb43b567d9", "value": "96:nLj2Jdj1Zl3SOytMqMNZMN+64IpW19oQ7MHlknyCpcH7p+eVy6+N/3hLeO:u3bl3S/63ZTNIpW19o72EbpWl3hL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812152, "uuid": "44d8d00c-b96a-4626-87c4-241095c99bef", "value": 6761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812152, "uuid": "cfdad03c-fa69-4da9-9eb9-00a3572bc550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812152, "uuid": "f96f3410-7e8b-4fdd-965b-fe6fe5b42825", "value": "fde3f0dc476337ad0d331bd01cd4fc66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2764a57b-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638773151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773151, "uuid": "e2a4a132-ee6e-41ba-884a-2735e7b3ff64", "comment": "Malware payload (Vjw0rm)", "value": "f3592ef1ba926bbbe23fd3733d65c4d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773151, "uuid": "5147f479-6053-4fbc-b80f-9704e7d82327", "comment": "Malware payload (Vjw0rm)", "value": "505998d8cb3f4b56a9551138bac8262da3be7813c05b932ebae7eba9dbadc938", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773151, "uuid": "78b85025-2a88-4f08-8882-26585bac7b27", "comment": "Malware payload (Vjw0rm)", "value": "d38daa37f82b1da083d88cd5b4d85962b07e1589", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773151, "uuid": "1bdac916-cd4a-45ca-96f8-0d342bb619fc", "comment": "Malware payload (Vjw0rm)", "value": "4c963a91e6b470e400f77f5325019f7bb5b7ae9a59779486911a6bf2817581aae656e72d2d236550db1cbb20211472e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773151, "uuid": "438ca650-bfd4-4893-a53c-38394def5eb3", "value": "T1FB83C7419F421C87B6B8D69340AD0025CE5DE2F8CF6AA49AD341F9CC0EEF2476793E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773151, "uuid": "38871285-3b6e-4c34-860f-88800abdf413", "value": "384:QPnPI1gYzbBg55m/sguLC7X/g/W/W/w//a/t3J/QSNm6wUgZiE://iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773151, "uuid": "08e46e15-6de4-4652-95a5-1293d480018c", "value": 83682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773151, "uuid": "f90b2201-cf3e-4f5a-9816-74c1949d1eab", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773151, "uuid": "227e850d-bdb5-4f47-ba1f-0119135a555f", "value": "4988109_Payment_Invoice_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea5c973-5698-11ec-96a4-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1638797323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797323, "uuid": "ac4b5cb0-a9ce-43c2-902c-35136c10b1c7", "comment": "Malware payload (CobaltStrike)", "value": "bbfba65ce17191fe89ee93fbeeef2550", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797323, "uuid": "80f7ce88-1a6d-433e-8559-27f66e8a2ce4", "comment": "Malware payload (CobaltStrike)", "value": "5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797323, "uuid": "1fb463a0-24e0-4dab-88d8-d3fa691b635f", "comment": "Malware payload (CobaltStrike)", "value": "1da5bb8650e1845edaeb6556cb03b8665a2a2c06", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797323, "uuid": "8c6892c9-77cb-4db5-8736-6a8e99b84d81", "comment": "Malware payload (CobaltStrike)", "value": "a85939114331fc1e9f4c7f1d47d2872c3be89096271b4bccadb54381f3f443c683a16b7ae4c648a7bcaa366e83a879ee", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797323, "uuid": "4702f37f-b991-4313-8229-e3c06a00886f", "value": "T103249EB17584D036D0570438624BC77E5EF9F9F616719883FF845AA69E32393EB2A203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797323, "uuid": "05c7dcbb-3d67-449f-8976-1c9e9dec68ed", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797323, "uuid": "b7bfba86-7d08-4afc-acca-6b1d559e9851", "value": "3072:ujh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15u:ujdFKdoSxvixTxUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797323, "uuid": "6dd3d421-561e-4f5a-b401-d3a36a6a789a", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797323, "uuid": "44ef8395-ed3b-4cc1-ba5e-c8b2ea2cbe82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797323, "uuid": "04261bce-1604-40c9-9bd0-84322863439e", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8eaa2b-568a-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638791222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791222, "uuid": "27c890d4-9ec5-4478-b2cc-259277c46bcd", "comment": "Malware payload (CoinMiner)", "value": "ba0bf944f024157dce2141a5d86d3060", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791222, "uuid": "ba1960a2-ea53-48e5-8f8d-375560396bf9", "comment": "Malware payload (CoinMiner)", "value": "50ba4240de75cd27ebbae766b98a51aa9792f87b22f9d589ff1921bb95d65bb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791222, "uuid": "bac25534-5ca8-4b8c-8264-5c3d1764a258", "comment": "Malware payload (CoinMiner)", "value": "7abcf8e5db062e83a8346b668bc75c8dfd772afe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791222, "uuid": "8ebf2891-6024-4740-aa6f-94a68edde5d1", "comment": "Malware payload (CoinMiner)", "value": "5e9645c6fedcb3eb567c69cc10bb57c91696f4f998046dd91cc5fd0981171a5a70863f043e29738df184b434e21599e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791222, "uuid": "562e18eb-d84b-4b88-ac5a-686ec91e0957", "value": "T16CD533E747E4D5B2F29B08B20977CD83BE98653942ECC16164B861DFD6D9FE88130AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791222, "uuid": "de05cdb7-3b4a-4c5b-b3f5-fa04b24c3259", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791222, "uuid": "ff79df37-26f0-4463-a963-a6e114640cb8", "value": "49152:StgBziGC4KAAvLtEudkip5YU6MnqNGCAWNJN7SwYwnDHlAkn:SlGjAvLtXVFVCn+wY0DFAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791222, "uuid": "810e62d9-9c3d-4787-b909-74f8b8d3fee6", "value": 2770432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791222, "uuid": "85afbcc0-6244-4ac9-b3a1-2c594a1f8cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791222, "uuid": "aa10ef19-ecba-49d2-9d1e-33b9aa904859", "value": "ba0bf944f024157dce2141a5d86d3060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d39ebd-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638776283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776283, "uuid": "f7938de1-d534-4c34-acdd-7137702502fa", "comment": "Malware payload", "value": "a7cfa9ee6a647e2ec24e98a40ed69e22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776283, "uuid": "4e18f124-8df2-43ff-b392-7eead622bf72", "comment": "Malware payload", "value": "52fc67ebd30f81aba4e572a8e4c23a1b2645f1bb328497f061ec8a19ed6a543f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776283, "uuid": "6d2df359-51e0-4bfb-95bc-bf8ac1541fef", "comment": "Malware payload", "value": "f0e4f8d59317f826395acd9419ccff8fda32244f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776283, "uuid": "a705dfca-6f8e-4bc2-b1c8-c8b9bc9751a7", "comment": "Malware payload", "value": "9ed9832784f57b9fe88b1b8a617cb267b843c4168984afaa6c7886aa0422c376fc52b76f8456cb0d5a9a6c1680e74cd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776283, "uuid": "9bfba51f-75c5-49ec-ba29-a7d81c9d999a", "value": "T1141623D93602B1DFC663D0758A54DD78EB6079B757278203E0275AAEEE0C95B8F240F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776283, "uuid": "d907bc49-1560-4de3-9dc1-9eeda4ba0940", "value": "98304:QpaJ9knQzbAJrVteIMLR7vDnidEyTDt6FAxY:QpaXknQ4lVteIiNLUEYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776283, "uuid": "3f450ba2-1c33-4096-ac3a-57be5027c124", "value": 4148736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776283, "uuid": "2c5eb71d-0d76-4dc5-907c-16d1b84dadd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776283, "uuid": "f0029d8c-5905-425d-8cc4-a6aa9c1fb49a", "value": "a7cfa9ee6a647e2ec24e98a40ed69e22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfd197a-56c9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638818580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818580, "uuid": "b1ea17f3-92bf-4d0e-94c6-e6f2cfcba9ed", "comment": "Malware payload (Heodo)", "value": "82c82adffb736f7651be82ea0555f10e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818580, "uuid": "0d4c7bdd-b9fe-48a4-9831-e74652136de6", "comment": "Malware payload (Heodo)", "value": "53279dd3d250b0c9cfb5a56fc0c62477be9be897e4c97c0bc36098831c904470", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818580, "uuid": "527ae0e3-ddb7-4ece-b8fc-8032a0ab8074", "comment": "Malware payload (Heodo)", "value": "dd5c49e92da5b280a1829593249aa743050cecc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638818580, "uuid": "9e5e02b9-7680-4163-9f66-83ed052b0f83", "comment": "Malware payload (Heodo)", "value": "53b3d9e9024b9496b3c6a104206a8d94531d122b1b85924f7b9f1a9ad3a0fe549c7f2efaaeee0c24fe2d4067fe56f504", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818580, "uuid": "4176d043-32b4-4ccd-abd9-15bd24a5cdf7", "value": "T101F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818580, "uuid": "5af50046-c5fc-4a60-9519-da4d0d2c77c5", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818580, "uuid": "e64edfc9-3d6d-4f63-a77b-ac19c7408ee0", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/o:JapiKiBEmj4GbOX399Md9J/0Te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638818580, "uuid": "67dfc0c0-78f0-4430-b9c3-1c7f679acc34", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638818580, "uuid": "8170c707-388e-44f8-a1d6-eff8e411346f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638818580, "uuid": "37fb6f06-9544-45b6-88d8-1511314c6b9a", "value": "82c82adffb736f7651be82ea0555f10e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d910e729-5688-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638790629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790629, "uuid": "e1c7cd6b-78d4-4340-83c3-590d9f68d727", "comment": "Malware payload (Formbook)", "value": "f75726844d19c528686fc2a7871fa232", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790629, "uuid": "0b0398b8-0ac9-44a8-a383-5586a6bcf06f", "comment": "Malware payload (Formbook)", "value": "533ea9197b5f56cc362b41c0cc8d35e2dea9df8581e608a7944f59bf9bd379c6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790629, "uuid": "d3dfda9a-65d9-405a-a7b6-1371cde0cb7a", "comment": "Malware payload (Formbook)", "value": "0f0509881a384bcb1b01ebc711a4a405dd918fb2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790629, "uuid": "7b9ff2ec-1a93-48d4-acb4-79839d43e352", "comment": "Malware payload (Formbook)", "value": "b82eb4ca2e062567049fb517ba5336b59a62efe8d84f4ea7ea074ca8bbb5bae95fc2536db1e321cd04282b9ab95a5470", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790629, "uuid": "b48a8e32-bcc9-4a6d-a296-465ed025b46b", "value": "T10D85335B423B585CE6192C37E0761A772EECEDD6921BD5417838F38A8FD1307062A2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790629, "uuid": "6431ef23-fd54-4b3c-8dff-f6b75bccd300", "value": "49152:6lnouSlGTgZWZUSbOdG+4t7NWw7N2od93Ayt9/HS:6t1Eo3jDNN93AyX/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790629, "uuid": "afa906d1-34fa-430f-9da6-68c4cf2ad8a0", "value": 1790800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790629, "uuid": "f85e0ad1-1cd9-400c-8e96-bb71949cacbb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790629, "uuid": "b0050f05-9c7d-47d9-b4fa-04615fb85004", "value": "NITAS POV211206.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37836b25-56a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803243, "uuid": "6ff34cf6-b076-4821-9270-a2936996ae95", "comment": "Malware payload (Dridex)", "value": "63291def8f1ab3adee2bb365e53cd340", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803243, "uuid": "0cb3534b-465e-4296-8023-dcc3d52a0d76", "comment": "Malware payload (Dridex)", "value": "538f434173ee3ece95dfb02d2205cbee684ed08180aa716044a26e7b0152806d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803243, "uuid": "e771c5a5-0935-465b-8e03-9b78e5acdc6c", "comment": "Malware payload (Dridex)", "value": "9124ed5f557279acf93c980b5c785e5ac77e578c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803243, "uuid": "33a1e69a-85d7-4c8e-8fec-27468519bbb6", "comment": "Malware payload (Dridex)", "value": "a8e04262ec227877bb7d0cf711391546d83530f2307afce57098bcd754db387766c794956c9b33bd1a4908f8e7ec8a08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803243, "uuid": "6652d79f-2de5-4895-90c1-de5eed28707a", "value": "T1CBA49F7CECEBB436C411C7F0987793990E352619E3FFE6E0362B9087A7566600A4589F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803243, "uuid": "dd79f4c0-c150-4d8e-954a-bb240c5f8c58", "value": "5293be9dcc3fe4423188dd90c7dd2d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803243, "uuid": "35a73b36-c1a4-4354-ba67-582c4257ec7e", "value": "12288:/QG80io88EmEkECG2EGoyEW+DBY49h4oJIH7le:IG80io88EmEkECG2EGoyEW++HKyle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803243, "uuid": "97dc268e-484f-4248-97ae-4044e753367a", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803243, "uuid": "9816fc4e-499c-413a-9b54-e95ada9f3101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803243, "uuid": "a702db33-ec13-43f0-b44f-cc985f166036", "value": "63291def8f1ab3adee2bb365e53cd340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aee0aff-56cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638820805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820805, "uuid": "4121c199-56cb-428f-bda0-dedb9fa8378f", "comment": "Malware payload (Mirai)", "value": "615efd8ebfe11f962016505691fa532f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820805, "uuid": "39e91f9f-3f9d-4873-bacd-c6b6158fded6", "comment": "Malware payload (Mirai)", "value": "53fd73f8df2d6d452f79544e0e77b657c8a5986f3492cbfdec58d6a4e2f47185", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820805, "uuid": "28e6aba1-0e5a-4602-a081-561a1bb5014d", "comment": "Malware payload (Mirai)", "value": "f598b05398e90890a67341ef02b804042505c13b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820805, "uuid": "04a77468-5da8-459d-af83-081438ccf82d", "comment": "Malware payload (Mirai)", "value": "e79952a2d5c8b1cddcedeb6af2499a47c8659ec0ba1e29b5e2fc29d9c816498a1d791887a64f76e1b4ced84ed3efa97e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820805, "uuid": "27977d33-f70f-4c13-85de-975876a3d5f9", "value": "T14BC32B46EA408B13C5D61777FAAF41463322DB5493DB330689285FF43F87A9E0E67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820805, "uuid": "27de2730-202e-4f21-ac2c-c996005bd2b2", "value": "3072:v8PXmy9MV9JXM9fN30yDShgFKeqBGXCwrM/9Jwu/:EPXmy9M2T0yDShg4ejXCMM/9Jwu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638820805, "uuid": "e02f612d-0b27-4f17-9adc-5222af1f713b", "value": 128880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638820805, "uuid": "17647248-c8e7-49cc-8a2c-58a9dd6a15a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820805, "uuid": "40cbe2a0-aa7f-48f5-8d75-750da19fa7e4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed3ec98-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638776278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776278, "uuid": "121c4630-7256-4dab-b499-961114a9a556", "comment": "Malware payload", "value": "b94f3a108e0a3de257b4d07773846c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776278, "uuid": "faa77a60-fb77-4959-a75c-0ff893cb4c32", "comment": "Malware payload", "value": "558fa0fb510902adcb02eb734b1574e4021acf654762d180f82cfcb34e2457f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776278, "uuid": "d39220bc-7931-4a10-acc5-46cbfdbe13ca", "comment": "Malware payload", "value": "c680e5eabfdb6d37c407b7b014e7810223a75965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776278, "uuid": "088425ee-4c88-4816-94f0-473ff7f7925a", "comment": "Malware payload", "value": "e74cf253ce4f1a3fa9565d7e50908afe049ce09fc2d6946cbf59c2563785ac7a78f05839663aea36c8bba9f889c3b99b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776278, "uuid": "2fe92167-c5c8-46f5-bdae-68273656d84b", "value": "T14E2633F0BAF1B9E2D6A2103FF4F4513C77DBCD686801567B964BFD8A18660E124F190A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776278, "uuid": "6007aba3-4219-4d3a-a25d-3b6ca671bb07", "value": "98304:/7a+4GWBqDHTFH9X5d7duKXkgRgIxc20PWBXXlvycUD:Ta+B/Ht8m6IxcXQXXlvycW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776278, "uuid": "eb45bcc0-4074-4f5f-8462-61b35b2da290", "value": 4712448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776278, "uuid": "0a14a1ec-f72c-472e-85f9-d0f6ee4aa79e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776278, "uuid": "d59d32bc-a1a3-495e-8072-750425ea5eee", "value": "b94f3a108e0a3de257b4d07773846c5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e92f25-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778249, "uuid": "a069eb0a-965b-4494-af9d-a29f0e4b5d50", "comment": "Malware payload (Mirai)", "value": "9233a34789cea7315f66b392e9948771", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778249, "uuid": "ec8e3e3e-ee8a-46fb-9946-7cc927b56375", "comment": "Malware payload (Mirai)", "value": "55a699f6b3988ef4ae07e7206137d7d8ec2fdb418c68b52c3b0d4db91e90f9fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778249, "uuid": "dcd24d85-a7fd-40d5-8f26-657fe206bbe9", "comment": "Malware payload (Mirai)", "value": "38c435af02377e92a6ae10656c4ebeb08dbfca16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778249, "uuid": "f6118b86-8096-48ed-ab0d-09311f449a93", "comment": "Malware payload (Mirai)", "value": "953936ae33a8a154bedd1ac584253b54120ef80ca7f1394721438f54f0b25e4c9efa7c0f04730b0fad968fdddcca219d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778249, "uuid": "ece1481a-156e-4280-83cb-274ee8ec76c0", "value": "T1BD53122CCD0A2506DE705C723E5C9E549F09CFD4E7FD21D3066688BE8A42E441AED4BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778249, "uuid": "d64b125b-dbfd-44f7-8b16-846b8edd368e", "value": "1536:i3b99FVnbd7BZMqTBw4Al0sAqMLO6FCQkLDy9uq:i3RVx7FBw4Al0xqMLHDkL2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778249, "uuid": "c9ab4415-f68c-404f-acda-8eeeb73fa9fe", "value": 61056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778249, "uuid": "aaf7e9c6-5c1e-4d10-a8f0-64c1cf5da0cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778249, "uuid": "21d5063c-d850-43f1-9944-d986da8f0a0b", "value": "9233a34789cea7315f66b392e9948771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb11f0c-5696-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638796652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796652, "uuid": "eb436065-9218-4e3b-ab70-fb202186cbe0", "comment": "Malware payload (Formbook)", "value": "13774cf9011ed10f4949228b2ac857b5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796652, "uuid": "8cc55f05-03df-4438-9c01-57ff0ade3b2c", "comment": "Malware payload (Formbook)", "value": "55faafc17f8c9896d17513ab815243548d8e130a48adc36f402a39fc974ea7e5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796652, "uuid": "594aba39-9eac-4ed4-99e3-3d98c35d33c1", "comment": "Malware payload (Formbook)", "value": "fdecca78304a9aedc0f5d6efee3af47507acb180", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796652, "uuid": "b28e02b1-c05c-4570-80a7-2f1fa06a826f", "comment": "Malware payload (Formbook)", "value": "14d74757a792d14e99378d86d36b1593931832b540fbe99e5dc8c01c61c59e990ab5c35a524d9924e7d3f0bd8651461c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796652, "uuid": "de482f67-1398-4a9e-acde-751d3f9e6eb3", "value": "T1F0556A5C317024AFE83A853145540F779EF12C7E866B93CE721734AF8ABD9468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796652, "uuid": "e7f64f6c-f6bc-4759-8f00-6f926a7ac2d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796652, "uuid": "6b5f0932-fd01-49bc-912c-60561d8bf51a", "value": "24576:y7DLP6yv6J3VNsLuN/1rCSfdmO5ADWeS0w09F7YbRYvouo:oLPvwDsKNtrCcdmOinSHKF7Ybvuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796652, "uuid": "b4902a51-9d4a-4d70-85af-0cd474d203c5", "value": 1399296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796652, "uuid": "7f2b2ce6-c8b4-4348-8b9b-0e9490abe9d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796652, "uuid": "a758c05b-321d-46a4-9a20-431a48b9f1aa", "value": "SCAN 9384799839893234 PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da679546-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638782471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782471, "uuid": "bc0d731c-04e4-4cf3-a0b5-717feab1e905", "comment": "Malware payload (Heodo)", "value": "ef9d2c289e5dd73f43a30dec94571ada", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782471, "uuid": "39c4fbf2-2466-4692-b5cd-7814c84bc4ac", "comment": "Malware payload (Heodo)", "value": "56e13120f0e4e8599ec94f88381c175b7fe3b329378850303f8b8b17faaddc59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782471, "uuid": "1237db96-da09-4645-a061-99f63168fffe", "comment": "Malware payload (Heodo)", "value": "a9502cb4dcd0f05233058f0d7912fbb686f73989", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782471, "uuid": "a23cbe30-8720-4ab2-9777-c648a464c9c7", "comment": "Malware payload (Heodo)", "value": "34fa3f370c214c43f15ffac7e04a5d367369b01d896abf93a6c839acceeb4a2482e03209a1e63c971cc8fb3cf4244127", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782471, "uuid": "defd3811-9fe0-4b52-8ae5-a6d351c9bb6c", "value": "T16D356B00E640A137F9E710F681BB96F9993C6730236145CB52C86BF9EB256D4BE31B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782471, "uuid": "b3528c9e-b0b7-4620-b142-c63d44d3d4da", "value": "0e582c14d4ce6cb9a419652d1611fdca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782471, "uuid": "c94c3f9d-ed4f-4139-aa5b-04815cc80e46", "value": "24576:MFpGzwCDD/Lff9f5/nphf4GbOXvVJ7Hu8bTpJ:MDwLXP/ivO8bTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782471, "uuid": "4e605e4b-28b4-4e20-8470-a9983a02d3ee", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782471, "uuid": "b220e648-7b08-4ba5-8060-2de6d5fda823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782471, "uuid": "207895e1-1e11-45c2-b87b-92ee51304e8c", "value": "emotet_exe_e5_56e13120f0e4e8599ec94f88381c175b7fe3b329378850303f8b8b17faaddc59_2021-12-06__092106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb84d22a-56ae-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638807008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807008, "uuid": "ce82fbc8-bcad-471d-9c16-2d175eaa219c", "comment": "Malware payload (Mirai)", "value": "a05d6930f4e87d448fd71b73db886ca1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807008, "uuid": "62f181a6-9c34-4308-8019-2005c9646973", "comment": "Malware payload (Mirai)", "value": "56e1a81bbff33d2c5f33a91e90b4ab7e66b401f4b31048856e261ca0550193bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807008, "uuid": "a7023895-8224-45ea-b1ed-d5a148dd0c8c", "comment": "Malware payload (Mirai)", "value": "16e4fcfde94c846f75e24824d6b7f03cb7d43ece", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807008, "uuid": "7f3ed188-1797-444b-a725-9b88b792cc94", "comment": "Malware payload (Mirai)", "value": "eb3989f5978235b09524c79f6bdcc901f84349ca7d25461912ddbf35696188f90fc26561c84508564b737428bfe70bbc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807008, "uuid": "d72673c1-5c04-4cd1-9dc4-4a659069e51e", "value": "T1C0D20845BD829D07C5C94377FB4E028D3B6523C8F2EEB213ED153F56E68E527099A0A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807008, "uuid": "84e49f39-41f8-4baf-9d2d-c91cff185129", "value": "768:iqXvusczs7fSTWjdSwfqAIyw94RTHwbZn:lDczIfRjo8R+6LwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638807008, "uuid": "19606664-dbc3-4bd6-87aa-48efd7f5b1ac", "value": 30744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638807008, "uuid": "b9ced710-1e2a-4d5f-aea9-41e6d8e699c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807008, "uuid": "e3335264-9fde-4246-86bd-8bd23bd81478", "value": "la.bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e38d094-564b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638764224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638764224, "uuid": "f12f1df4-b69c-4d92-8f98-98e9022b63dc", "comment": "Malware payload (AgentTesla)", "value": "93a26601af7c4fbc907acce168adc12f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638764224, "uuid": "9068cd71-e297-4e58-b041-b94f3dff1616", "comment": "Malware payload (AgentTesla)", "value": "57165c811efa7269e30758b2ba2ddfafacf07ee5e1a8e0224f099bb5f21f1086", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638764224, "uuid": "e7d33c3f-aab5-4106-9ccc-bcc56ee1f25d", "comment": "Malware payload (AgentTesla)", "value": "9c4fff9cdd171fcf147098a52a2cfa64ddd45089", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638764224, "uuid": "e11799e1-a0ad-470e-80f8-61622edd0c9d", "comment": "Malware payload (AgentTesla)", "value": "0da6be6603e15c03345deeca7b388672196d7cc375f9f12652370cfe20136009a204edf719505085f3a71a7573725375", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638764224, "uuid": "3c4fbbca-a7a8-44ac-a669-66d21a14c3b5", "value": "T1E025AE7AFA1E6E44E2BC463AC4D724B452B68C769511D87F9CE430AE18F1FD8016ACC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638764224, "uuid": "8c92b386-0684-48b5-a842-2a5eec7aea43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638764224, "uuid": "b92a141c-a2de-4a46-a110-4c3eb94c93d3", "value": "24576:bXzBSD61TbeEv0V8IjzEwkNttttttttw7:Tz4DesV80zIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638764224, "uuid": "e8008a7d-ff89-44a9-8372-685ef5d7d264", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638764224, "uuid": "c3f7d6fc-72f6-4774-b93d-5e4ab709a437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638764224, "uuid": "d9eb3a02-489e-4016-9178-472f660281f6", "value": "wire advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35860df9-566e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779188, "uuid": "f8f6a902-c4c2-4cad-9b8c-f92203a45fe6", "comment": "Malware payload (Mirai)", "value": "9d937860e5e33fb55388a68ac712d9c4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779188, "uuid": "86d5b71f-4459-477e-a5fd-0fdf8b6a175a", "comment": "Malware payload (Mirai)", "value": "57a4f10c5dd254c32e461c43902390771a47945a73deeefba1eac3918de64fc0", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779188, "uuid": "bd9550ae-caa0-4a7b-949b-b37546ca03a0", "comment": "Malware payload (Mirai)", "value": "39360183238b85a4fd63a5f26309ff32ed2b0a3e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779188, "uuid": "1e439482-6b6f-462c-9291-87708d4fd97e", "comment": "Malware payload (Mirai)", "value": "b5c4d5ef78f896c313cbaef4da9243a974645b7f05f2c36b064f6e0c1ced522f0532a43578587455513218eefe022849", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779188, "uuid": "a3933039-84a1-4032-af15-b1e9e794d631", "value": "T12B03F1B3A62F16F8C437ADF440CA863CB910BA245A251F8E017655FD0DEEE4A1C1BF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779188, "uuid": "2a98d026-ea68-4c4d-bdf5-1c2a7abdefdf", "value": "768:SMd2EfMTILESAcxAnfpX8/wDstoidwDWkH2rWGx0AwDLcPgIni104:v2EfMTILEbcxAfC/h6DyZjwDLaD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779188, "uuid": "88ae30e2-df6a-4c76-b327-cc5868a99e73", "value": 41180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779188, "uuid": "f7506aee-2806-4643-a529-214b6470ca5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779188, "uuid": "4c47abdf-c732-4384-b366-4d72bade2da1", "value": "9d937860e5e33fb55388a68ac712d9c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626a365d-56bc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638812764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812764, "uuid": "f8957560-53da-4ab9-84f4-927392b75cf8", "comment": "Malware payload (Dridex)", "value": "ff46051b82db9f45e6cb9b9cf8767b97", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812764, "uuid": "8990d27f-17e8-444b-8d5e-688fca3f4dde", "comment": "Malware payload (Dridex)", "value": "582f2b77cf9f80dd31a175e417f18f0e8a35a6a824a89d9ac6335753b88bb25e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812764, "uuid": "3d82ff34-9928-48cc-ac82-765e3fa7a242", "comment": "Malware payload (Dridex)", "value": "2bce24314d58c9fd6cf18ee50bb292c7f5b4d2c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812764, "uuid": "eccaaf36-4477-4fa2-a2a2-86fe69e5bb95", "comment": "Malware payload (Dridex)", "value": "f08849e7ea14dfa3559233dffedc7f910e837cacdd7ac181f6bd08457d82a52e02db4f08e48f0fa9c37aba40ac3c03c1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812764, "uuid": "c5b7d262-8183-428f-904f-ac9f826d8d80", "value": "T10EB3126FC6C9DD19C2D3F0F4010E25F3B465849085841B9FB2687BBC96AC8E78F6E466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812764, "uuid": "c473342f-1d72-4131-937d-d50ae793293b", "value": "3072:R/95l/pzk8EOKOf5FTOB1SR4CH2URwHZ16ad+p:RrzUOKGzTOB9CH2Ey1dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812764, "uuid": "cb563fe4-ff70-48d3-9364-81313044b2ff", "value": 111390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812764, "uuid": "97f20443-5116-4284-ad10-1912ac70dfd6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812764, "uuid": "1e61567e-f581-4e31-9da3-b0e56a10a477", "value": "Bill-4673709942.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf8cb6f-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638802583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802583, "uuid": "b0beefff-976e-4cb8-af33-3838fd7dd897", "comment": "Malware payload (Formbook)", "value": "847f0939e00190f07a67970f14397b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802583, "uuid": "a4d34dfb-820e-4a97-968e-5f511b9781de", "comment": "Malware payload (Formbook)", "value": "58e52ea9da334cfd4d28f0fd1e1d83f5c3f626d350b20b31122efe4cde828851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802583, "uuid": "f1194bfd-7dc8-41bf-b03a-8e1d4a8fed9f", "comment": "Malware payload (Formbook)", "value": "0d9e1d542b3cbeb61ecca4f5ac47dc346851a006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802583, "uuid": "47a443be-f60c-4eac-a783-c279b30cafc4", "comment": "Malware payload (Formbook)", "value": "a8478b07a23e3c7d48ac4f8e3634e5dbb7f1be6ff623e9863c0c6380a34cda8d361538ad47b6931fb66b1cf5dd560e6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802583, "uuid": "dcbbb773-f71e-49b6-ba22-1f5da9879fe3", "value": "T171641266AAC05B77F3A28B7118B7DBADFAB3E14106BA916313541EAB1C7B007CD1D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802583, "uuid": "e3df8d54-949f-438c-b781-be7ef72d5d89", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802583, "uuid": "44521405-40d4-4868-a1da-cfbba96c7b46", "value": "6144:rGi0ifrJHdNwV/Xy+QtPZkrTvGMmio0O/ve+Q/KRPUFf1YIUTSMUT:pfrfNwV/Xy+QtPOrz+VQ/EPWdYOZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802583, "uuid": "9ed9ea38-d763-4be8-84a2-9424028a3ceb", "value": 321345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802583, "uuid": "7c631469-6a34-45c5-9db2-315496d1587f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802583, "uuid": "195dd04e-8b13-4593-816a-cfa9b2561655", "value": "payment copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11380083-568c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638792012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792012, "uuid": "d9b7f19b-10f0-415a-b186-5ff63c22ce03", "comment": "Malware payload (Heodo)", "value": "72414e333fa6be400cc66b35ad2af085", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792012, "uuid": "76ec7d45-c800-471f-95ba-5dbed6a76830", "comment": "Malware payload (Heodo)", "value": "58ea616ebbe9bba553c1a775b69d373e48a4ed20777c8bd310ba2bd380caaa10", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792012, "uuid": "c24b6264-036b-4e0e-b191-f3e7c64fdf91", "comment": "Malware payload (Heodo)", "value": "180c4d6e2cbf34af47471e508bab60012f5ecdcd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792012, "uuid": "902d7e87-4de2-4649-af00-d6c822eee1ab", "comment": "Malware payload (Heodo)", "value": "340e31971895f62b2a154a649091c98d25acdcf1ffaf39026b5011321218e22624f02d22f0d18476fb1d535f3a952037", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792012, "uuid": "8c2b276e-7951-4652-937a-b15676b7ccf7", "value": "T197A44A40E301B12AEAEB00FBCAFB49AD9568AB1413D769CF55C86EE5D7184D03D3261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792012, "uuid": "97ce0d8d-3e6a-479f-8842-04e4e6d7c5fa", "value": "6144:J2BMQOuPfzZLawDZj1MKVeRByYUTSRRuEhwdSyGVWHmw2MnvXkWc9wNbgY4gK+U+:JKUuppiKVoByYUTsRuEhj4GbOX39U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638792012, "uuid": "be84bd08-27e2-4eba-af55-ac1a4e6d8bdd", "value": 464283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638792012, "uuid": "4ec80a1f-f65c-45b3-a380-9bcc20baf0f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792012, "uuid": "3e7ad332-9905-408b-b945-342d338ab2b7", "value": "emotet_exe_e5_58ea616ebbe9bba553c1a775b69d373e48a4ed20777c8bd310ba2bd380caaa10_2021-12-06__120007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042f0e55-56ae-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1638806593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806593, "uuid": "62fa910e-616e-412c-b818-d496b8324e78", "comment": "Malware payload (Gozi)", "value": "69913cadaf9acc0f894e7e0949475398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806593, "uuid": "580d5372-f5b5-46a5-ad84-92d61fc8b1af", "comment": "Malware payload (Gozi)", "value": "59873937922811d9a28373ebc6358551d3d651f81c4e7d5b49e7aadc2888cce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806593, "uuid": "1b3f4b84-353f-44cc-9bbf-83225486c890", "comment": "Malware payload (Gozi)", "value": "7793f5d8bed0a15a985f48abad52436fe7e16a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806593, "uuid": "361f36f2-fbf1-4a86-a298-dfff05edeeb6", "comment": "Malware payload (Gozi)", "value": "98afddbb02f589d84322580b6e1d44c6b650902962d4079fa5e02662ed7691f994f708436b47d658c01b2bfe6817e0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806593, "uuid": "28b50423-87b3-4100-994f-df24b43b4fc4", "value": "T10C245A6AA7E40595EC6BC6B5CE52D61BE7F374092B14D30F03B0CAA66F17722B21C352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806593, "uuid": "f1191529-7be9-4459-b72d-494308ded910", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3Luiy5nH:cxb5wvtKRvSxY0G+D7uim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806593, "uuid": "fbbf1f19-b0e7-475d-b1bd-0be848368b92", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806593, "uuid": "443b27b4-2c52-4db9-84d6-688c2b20541a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806593, "uuid": "beddbd93-db1e-4cfa-93c2-b80692b60c4d", "value": "d780000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b010b34-56d6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638823999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823999, "uuid": "f1529aa7-1362-44d9-9c33-0bdfa4d2864d", "comment": "Malware payload", "value": "fd9c34bf68cd57fe9bf33b3d837b43f8", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823999, "uuid": "bf56b403-1b08-401b-b8e4-5ea652b02259", "comment": "Malware payload", "value": "59cd9dc7a9c2bc5f4d00c69e28c55d6622f8792fe87b016549c30e76736e3b58", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823999, "uuid": "74e1e0e5-f3cb-4f3a-a14f-9858f6278bb6", "comment": "Malware payload", "value": "6aeb21d0067a98b0836d0ba16db95c0a624f8917", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823999, "uuid": "8016b4ff-5b0b-4f51-aab3-4a74da231ff6", "comment": "Malware payload", "value": "e810ff62939c84edbd0bf64e66968182b26d500b5b17ccc5e2a72acef0a1d8ebbf81d7aec5019e98e3836e6bf0ecabad", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823999, "uuid": "24e3aa6e-a55a-4b20-82f3-35a54f9b2a78", "value": "T15083BE1E9725A42DE3992839930548F5A28902A3FA00F40F1FA7B7611BF59D7F7BD09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823999, "uuid": "46f58c56-c91c-487a-8ecf-30f496ccd348", "value": "1536:ecuOKmMH2gMyhmw7AhhDnp+hz/Ck3myG7lZZZZZZZZZZZZZZZZZZJ9:TlK9MCmw7AfbpKr329", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638823999, "uuid": "1f7f5772-0734-4748-99ce-64adce333066", "value": 81869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638823999, "uuid": "9695f74f-0eec-458a-88c7-5a5ea79552cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823999, "uuid": "1892ebed-0faa-47b6-8619-8b7e0593290c", "value": "list-109428426.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9158af0f-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638760444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760444, "uuid": "e0aea040-fcc5-4746-b143-40f0bac8f37e", "comment": "Malware payload (RedLineStealer)", "value": "c96e66eb9c645784601a6c0267856884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760444, "uuid": "22364880-85de-48e5-b31a-319ed5cbc74c", "comment": "Malware payload (RedLineStealer)", "value": "5a68552297b1a15eb91df368e34aff338f266f188d853f83ce800c7de7fdaa48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760444, "uuid": "c3c12faa-9a1b-45b0-9735-e311569ff18c", "comment": "Malware payload (RedLineStealer)", "value": "1a4aad4768d0a6fcefbad459c79bb2a4983a6dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760444, "uuid": "a15a55e4-8eea-4b94-a184-1985e91baa0a", "comment": "Malware payload (RedLineStealer)", "value": "09b1e659f267dcdbdb7bde65a31fbc1fad0f3532501360d57375b573e1cd0130f81bcba4e2d2121200181d65a3295dc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760444, "uuid": "94f14d20-385c-42aa-b664-a8bbb12e5faa", "value": "T17DA33A5437CC8918E6FF0F706CB0115843F0E5A3B452E75F5DC564EA2E66B81AA22AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760444, "uuid": "b9426d4d-c55b-496b-b1de-a0c3238c18c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760444, "uuid": "b3cdcb44-0bd8-4907-97fb-45434167530c", "value": "3072:zDj+D4w3cmefk7/vb6ZGsDIejO83KII9v4uJx:U4scmefk79tmux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760444, "uuid": "24f04420-4e6c-4204-a491-6b738ef2986d", "value": 106712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760444, "uuid": "4c621a0c-abf8-4ea0-8790-11d6210eeedc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760444, "uuid": "ae9bb0f3-fd5b-45f9-99f7-6be0752963c1", "value": "SecuriteInfo.com.Trojan.PWS.Steam.21709.31737.12908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1db8ba-568f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638793696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793696, "uuid": "0b993703-880a-49a2-bf1b-e6e25b773b10", "comment": "Malware payload (Formbook)", "value": "83b3ff300291c9aa56318ad33aee9ec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793696, "uuid": "27a7daf9-3de3-41ef-8258-c6e8983ad082", "comment": "Malware payload (Formbook)", "value": "5a8d5ae67ced20c08bcdfb390c7424db82ee389b96303fe2e1f3e7e183da3166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793696, "uuid": "25c9e563-34ec-489e-ac5f-fb7b1b955018", "comment": "Malware payload (Formbook)", "value": "875ab647259a26c7c35e04f7ce1da47d4400fad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638793696, "uuid": "7bb218b6-f89b-4fde-81d2-c2d7730439d8", "comment": "Malware payload (Formbook)", "value": "76b6a71ecaa888307c3c696259ccbf71a91b8b17151a6455a965dcbd3366dfc77c3d4051ecaa6d326a96aa4448f9240b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793696, "uuid": "928b7fcf-5e3b-4e67-b745-c38f31442e99", "value": "T1EF55691C25B5086BE97D1A354421077B4EF26C7D997BE3CD3B48316B0BB36840A267EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793696, "uuid": "f3955079-c5be-4e2a-a52a-8b76e9fd3926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793696, "uuid": "be9d744f-ff6e-451d-aa96-5c473545eebb", "value": "24576:ulzbUN9aCnPBp+kqKhu0yUqEfGH/acgMTnoRagW+K8MULl:F4O5AzQYDacgaoLTMULl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638793696, "uuid": "f0169d57-3936-4036-9983-a212178cc7c1", "value": 1303040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638793696, "uuid": "7f772bc3-3bf2-40d9-bd5a-8164bcceeffb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638793696, "uuid": "019f7977-2266-4568-afd6-9c1b9a79ea06", "value": "wOSmfOhoXNtfGNb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c168d9-5693-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638795211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795211, "uuid": "92d5b312-d024-4e3d-b2c5-3a46bd9449bf", "comment": "Malware payload (GuLoader)", "value": "d121a52056aaab1c1a7fb0ee6cec016b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795211, "uuid": "fd65cc5b-ba23-4743-ba54-81971716ea86", "comment": "Malware payload (GuLoader)", "value": "5b33ff0ae84e0ff9fe0c0b742a6a8e1eb379a202f46c608b917d784c4a59a400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795211, "uuid": "c6f56f18-8414-4bb9-aa0c-bfb6f035217a", "comment": "Malware payload (GuLoader)", "value": "d5075f726fe625914a6b503fb5a6ee94c6b87d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795211, "uuid": "ed135391-3fed-4894-b682-2ca253a594cb", "comment": "Malware payload (GuLoader)", "value": "97fa3c4643908e002fca44d4d03ef22d9ec6eed01b1c2ad9a09a43076318778da61b7eed1fe3cb421632aa95aabefd9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795211, "uuid": "c29649f4-ec77-484c-b998-58e78e57b303", "value": "T140E3C592A115B245D34EBDB4D4EDA81DB7D478223005ADCBB2C0BBDD71BE64271A2B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795211, "uuid": "0f5fbb90-7510-43b5-b3a8-f7daf55b6dcd", "value": "4a788e5c09363cd76bc3ea29cdc64b14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795211, "uuid": "d1fcb720-48c9-4622-9ac4-62060171f260", "value": "3072:JIYiTC8IdyqSa/bbmAAVG/LnRjc3V1gpP3rf63M20Rv:Yc7/btZc3V1gpP3rf6350", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795211, "uuid": "71b60e5f-8f2d-40ac-a966-fb998259d017", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795211, "uuid": "91247b38-f78c-4fda-b879-6cc5d5552a48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795211, "uuid": "2d14b353-aae3-43c0-9f12-28f1e3448330", "value": "SecuriteInfo.com.__vbaHresultCheckObj.23524.30062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589716ae-56d1-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638821767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821767, "uuid": "ad026c15-f7d5-44b5-a7d0-6a746085cc2a", "comment": "Malware payload", "value": "a90299e21034855725889a8ac9929412", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821767, "uuid": "d3a3b756-cc99-498c-affd-4b3e1b853b28", "comment": "Malware payload", "value": "5bbfa7e3d441b0bed8c3996d7cd02011454baf595f412abd3b0b629d32658664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821767, "uuid": "6ce94666-069a-43c4-8380-1d3d73a80749", "comment": "Malware payload", "value": "ccd314f19289efc075fea89dd82ee4a7f6e848bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821767, "uuid": "83af084e-9c24-4913-844a-dbb5416a61f3", "comment": "Malware payload", "value": "8d380555f6f820957975f057294a530793b7caaa3d89bb3a72aec843b9fa97865a767a9c50b4dfdd027466d3c8633c9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821767, "uuid": "fe63235d-b8ef-4066-88fc-8c85c324a439", "value": "T104F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821767, "uuid": "acc46c3a-f4ec-4882-9948-b17110671c48", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821767, "uuid": "f604b0d4-9dd3-4170-98c1-703df4c9b415", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/1:JapiKiBEmj4GbOX399Md9J/0Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638821767, "uuid": "a4945225-5325-4a3f-8c34-0b9617197a9c", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638821767, "uuid": "d42c4fa3-fc20-4abb-9064-616fa6a3c537", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821767, "uuid": "723c456f-274f-46f0-9fb2-ca8e28c5e2e8", "value": "a90299e21034855725889a8ac9929412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793accf6-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638802495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802495, "uuid": "5edb6e50-e9f7-41cd-ba98-5ce51cc472c4", "comment": "Malware payload (AgentTesla)", "value": "135c18f187076169bfaa9260c3470de3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802495, "uuid": "6c456c54-e541-4380-9500-cc7fa570996d", "comment": "Malware payload (AgentTesla)", "value": "5bdea7a3684f9908aa6585265768a93b01ac74a8627c10a683d526f7b7a97191", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802495, "uuid": "39715152-945c-490b-8069-ff3c6b88812d", "comment": "Malware payload (AgentTesla)", "value": "d3c0ab9e44dc7679cd9bc65dbe7d5f712c88f7e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802495, "uuid": "25fd68f1-083b-4085-a9ba-a06e3fb5bfea", "comment": "Malware payload (AgentTesla)", "value": "47b7945e63378a4fbe5636c5f7fd98c5e94639de8404f6f2e8f957b9d53ceb5ff7a4c1bf1821d8e0d14a906b86fe7d20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802495, "uuid": "ab4d64af-1c2d-4029-aa91-44a2d54a5f0d", "value": "T18C55F1169BB8EE31DA79477F916072240F3E6E5290A2F78E314D74A51FF5B82C90039B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802495, "uuid": "268020ce-2689-470b-a635-ac12caf8eb5e", "value": "12288:6jNQLZzH0/u50Wtn4QWrDf4JMAFlJmYdVTOt6B:lLZzH0Wltn4QWrDwJM2lJmYdVCt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802495, "uuid": "13c7a753-ef92-42ce-bda5-edf56e4a693c", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802495, "uuid": "f611d708-e214-44e1-a9b9-735f035a9a93", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802495, "uuid": "5a9a25f5-77ee-4515-80b0-5cfb7d7c12c0", "value": "ORIENT TECH-RFQ #397875.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc34773-56b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638811471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811471, "uuid": "9ec2c886-7d8b-45ce-af08-8e25c75001b1", "comment": "Malware payload (RedLineStealer)", "value": "7a11245abdb3f5157e67fca9d57b2736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811471, "uuid": "4e7f14a9-c272-4ffa-b251-80023371885b", "comment": "Malware payload (RedLineStealer)", "value": "5be1a1c1113df7c6d95ef08abab80df47102efbe14b4eb391bf6db6a5b5c1ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811471, "uuid": "ca7dea23-2e86-4eba-a341-8162f773bb84", "comment": "Malware payload (RedLineStealer)", "value": "217a103a8e92a632936de2babfc6c3da050a353e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811471, "uuid": "38531e61-4c7b-4a9d-bf7a-e986a5bab111", "comment": "Malware payload (RedLineStealer)", "value": "b2ef1dcf5698bd139d1add5706a7193d13bbe581e1e657ed6025fda250f84569fb1ae3cc145e0d4da50be23b15f45d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811471, "uuid": "b5aca8d1-fc0f-4d9e-8a1e-2c7fde8c063e", "value": "T1AF151207A2E9813AF0F517704DFDA1671779BDA0AF74C78F1249A8D81571BA0AB38327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811471, "uuid": "7e1e1b84-dac4-4f37-8ce4-75a61861ab26", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811471, "uuid": "d4bfd9fb-3bcf-4b08-b5aa-54848ed56665", "value": "24576:BlGM1Y/6oXCHux9UJf2fNfLQt2dPadKneZlt:XGKYCoSOxpByYO6eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811471, "uuid": "735c6892-2132-4e97-810e-464f9ac064fa", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811471, "uuid": "7b39e655-f03b-495f-bf43-207f6e7b4f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811471, "uuid": "a94078f3-353c-450a-95a3-b5c251519134", "value": "PlsWnEU3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406fa47d-56a5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638802829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802829, "uuid": "19abed49-8cb6-4314-80f6-d31d668dba04", "comment": "Malware payload (Dridex)", "value": "9288db850ff73d8647a90d9d27f4881e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802829, "uuid": "1b3e545f-1b14-423c-98a8-d86c7b6df6d1", "comment": "Malware payload (Dridex)", "value": "5c4a8170fd811f2dbe2019a738a51598d6f874ed84626aef1b9786dc064014c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802829, "uuid": "c8dfe5d2-dbef-40fd-b5cf-c7d3ae7ab9d6", "comment": "Malware payload (Dridex)", "value": "46293cc364bd6032b62c7789afa019840ab855cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802829, "uuid": "4ad3944c-37d6-4082-b957-4b8a7f3d0e96", "comment": "Malware payload (Dridex)", "value": "58e3506a189396d70988f8b5c19d5220d5c2da2d3dd32d3ff89871fa570b8ee1e44840bc9b4bc30471cac69bbd6f245b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802829, "uuid": "db099838-77b9-4ef8-847d-8c410a25d369", "value": "T171A4AF67D1A2CB1AF5CCA2F3921A018ADDB64A8482F547D40CE8DC564FB7687F1B0D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802829, "uuid": "c4ea7eda-16e3-4265-8d85-5e3f30e136e0", "value": "9259df85dc28e34e237d850d94b74d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802829, "uuid": "1a8816b8-31a8-4f11-9f88-db2302d6e8d8", "value": "12288:cGAe6zhjzhVjTJVFRH3m0K0JRkyVnochOENqef6enkeb86t:ctDzhjzhVjTJVFRH2L0JREn9zx56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802829, "uuid": "10af5a07-2eb3-4d43-bfab-f5823aedf5ee", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802829, "uuid": "264569c9-7125-4959-affb-eb67ddf0abad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802829, "uuid": "e71fc3e7-f921-4264-8b53-6ab7401c57b6", "value": "9288db850ff73d8647a90d9d27f4881e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1920f187-56a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803622, "uuid": "6bca74d7-00e6-4d7f-8a16-f39c67cb1752", "comment": "Malware payload (Dridex)", "value": "cf917c6985923ee7db62e835eaa6a024", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803622, "uuid": "330a5f6a-0818-4a14-b3c1-f9b68aab17ba", "comment": "Malware payload (Dridex)", "value": "5c9389440889f023132e32ff96c415260e3149792038da898b9066213ef88c0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803622, "uuid": "9180b645-0a33-41fa-a43b-fd400008738b", "comment": "Malware payload (Dridex)", "value": "bd00f7e658086031b7bb66be415150291e33f0ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803622, "uuid": "05855f61-fa75-4be3-a075-46b5c97e5bb7", "comment": "Malware payload (Dridex)", "value": "00b71226b688aff67bdbdc0dccb3ff97823ff08c881883510cb8e53413b05e24ebb87e47252ce7e9ef9e7ab9e29affd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803622, "uuid": "86a798c5-cab8-4aa3-8680-1fdaa6c465b0", "value": "T1F4A4BF4FEEF690B5FA32F8B174528292E1CB9C752002B7D485616A58FCE4C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803622, "uuid": "104ce8af-0ea6-4f1e-a456-4170a2cd1ea5", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803622, "uuid": "64a38585-f085-4527-a48a-1be9a77f0b4b", "value": "12288:PCfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWRz:PCfzehtApz4lzQvzU3H2Jz+BbAt3A1Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803622, "uuid": "575cd286-23e5-47ef-ae6f-273373b5e5d9", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803622, "uuid": "1dc3a0e7-6bca-4d13-8f7e-df4dd67d3d07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803622, "uuid": "640c5e9e-60c7-4c3b-8dab-cdcb840831a6", "value": "cf917c6985923ee7db62e835eaa6a024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dcbdc9-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638776457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776457, "uuid": "438d45ff-87b8-42d1-8c7f-8685e15ba50f", "comment": "Malware payload (Loki)", "value": "f1d22e527253f4cd87eb490df707ba00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776457, "uuid": "bb1ab5ba-7d1a-49bf-acb8-56dc82754ba4", "comment": "Malware payload (Loki)", "value": "5d292d4801d37591a78cc668219f7a7279a830fbbe01dd8e4bbe4a8a7d43f127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776457, "uuid": "95c60278-fec9-412d-b6a7-705b233e30e5", "comment": "Malware payload (Loki)", "value": "c0cfb5fdf1ef8eec7cb7f0a753391e768bacb8fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776457, "uuid": "aea8a94a-0e18-4716-ad2c-6baec9baff76", "comment": "Malware payload (Loki)", "value": "b1f78a9e818b2966f204adae91f21f2f6baa25c69df3689e94ea4517ae7c3190dde503adabebd48f2785640aa835be21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776457, "uuid": "b5f8c1c5-45fc-4843-a2bb-ffec56a2fcac", "value": "T125352312369A1F37E13C5BF17636A1441BF662373AA9DE2C5EC130EE9621F618211F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776457, "uuid": "e933693a-b092-4165-8956-8ca0e25f8292", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776457, "uuid": "73bb0c3f-dc09-47b3-ba6e-6fe60d94fc9f", "value": "24576:Zpb+4mplmGTEs3zc1Rklry0FVCdE91M6a9FHZbvjNDxTz:vbTa3gs3zc1IryFdE9NOZ1xTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776457, "uuid": "7112e59e-9bcb-4cc1-a6e5-c0c7e715194e", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776457, "uuid": "5d34574c-3042-4d98-a27a-69d6fd74b4b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776457, "uuid": "7580a615-b7b3-4e94-b7e0-73f8b6d5386f", "value": "f1d22e527253f4cd87eb490df707ba00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13626bb0-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638782137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782137, "uuid": "b164d572-bd67-446f-a8c7-872e20c30f65", "comment": "Malware payload (Dridex)", "value": "79c2034357c210a37826ac2e107ee1f2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782137, "uuid": "11b276b8-0216-4bd7-bb6a-05bec5522c7d", "comment": "Malware payload (Dridex)", "value": "5db4870d9646dde76f182f741bebecd88eb5a027e0d11cc1859b0c0eedeb6582", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782137, "uuid": "c4ee3e7e-bc8e-4903-89cc-a71cd7383b5d", "comment": "Malware payload (Dridex)", "value": "93e961e97e679dbe38bb6bafc0d58061fb9f907e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782137, "uuid": "469fbcd7-71f6-424f-8ebb-221b906143be", "comment": "Malware payload (Dridex)", "value": "9c0af7a27e8998bdacdc9438f49c8b390aeec380925661a1861ea3ccfee4eb664cfae1f7d3b9127e7cbaa0c6c65b0102", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782137, "uuid": "32cdf4a5-de22-43e6-9305-2cd6955fdb0c", "value": "T14934B7D5A394C9A7DF20E9738D4E9A948259FDC4190B6FC3291C212DBF213B86C4E2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782137, "uuid": "ac732e77-6c61-4e9e-a998-9261d7cb9bd2", "value": "6144:W96FE76hr0d3n98AdwL3x2bVyyKC7AZrVyJPOiKRrwJGIxe14CRD1leKw:ada6bQbHZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782137, "uuid": "f0c3c7e7-b258-446f-b565-8e00fd6517b7", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782137, "uuid": "49b13862-3207-49a3-844e-43157ac5a930", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782137, "uuid": "f1479dfe-0363-41b4-aecd-303cbcee437d", "value": "offers-4567071055.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e17e12c-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638775364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775364, "uuid": "ca0994f1-0fe9-47a5-a6b0-b8d8488597d6", "comment": "Malware payload (GuLoader)", "value": "7dce71be9ecab744901717218a567e43", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775364, "uuid": "a0d775ad-94f3-4747-8f8e-b931976cb49a", "comment": "Malware payload (GuLoader)", "value": "5dc067cd7df8a358be3f6a4f7349a705a58e46de169080c707de2226290321bd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775364, "uuid": "57dc12a8-094a-469e-bee2-aeed2a3efb48", "comment": "Malware payload (GuLoader)", "value": "46829decbfadcaf3051d8bafb6fff00e8e1699f0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775364, "uuid": "7c3b7f1e-d571-4903-bfb8-abd31637980b", "comment": "Malware payload (GuLoader)", "value": "8324017b20b43537c7e10c2a33977a1daa8aa3a5f2dc51efe54de7095cf29597d2906e96cf70b0655e563f19ef944ccc", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775364, "uuid": "36c33830-8cfa-47e6-ab5d-639b98680a24", "value": "T15CE32A66AA80E6D5D559B7B4EE15F2AC9006BC33389004CB9DC77A6C9732783C1E3397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775364, "uuid": "91b4dff4-5fc9-419b-af75-6f617a447a98", "value": "460340e2ce791b610d6d419830ceb88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775364, "uuid": "b3c33a7c-6b67-4357-80b5-7cdb57cdc481", "value": "1536:CaA0KpClwbAbHfuLsVkM4Ica7QLYCHymvj5bAZ:CHwlwbA2uuIcfba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775364, "uuid": "9c9d97ca-c40e-4ad9-abea-8c5e3d805333", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775364, "uuid": "caf5e700-9c25-4f73-8ca6-7c2dfd93fc2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775364, "uuid": "346619de-e321-4cb7-bae7-bb227eea7b4a", "value": "Facturas DHL Parcel 48_20211206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95455b39-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638775483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775483, "uuid": "709be9dc-0027-4da4-840a-0fdcf6e17273", "comment": "Malware payload", "value": "b8bf27ecd45cc43809c10c730416a052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775483, "uuid": "eb0c7337-ea2e-4a15-b74a-41f94e1d0461", "comment": "Malware payload", "value": "5e2f3a0394815ad5f44f8655197d91dd34786d3dd597f9cf5e5b0e7c96d7a3f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775483, "uuid": "1f166ba9-ed0b-478e-85c9-edb9ceaa3286", "comment": "Malware payload", "value": "855760d29c5c87b5cd1031670426807ef021e4fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775483, "uuid": "c75847e3-331c-433f-9b51-114ef9361f44", "comment": "Malware payload", "value": "268307eef1165730dda39f19c6bf8908eb99292e943ad809e56ee9c0ba1c328a9df33f1745b2b907b7bcfd676a09d15f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775483, "uuid": "53289956-bcb1-463b-b6bc-a17f3b35bc08", "value": "T186A4F17276D1C032E83314309DBEA771EA79B93457359887FB800A6C6B32AE1C726757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775483, "uuid": "613fce90-10a4-4e1d-a190-2de2b174b301", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775483, "uuid": "a905bca2-937f-4597-8a68-ef53af66ceff", "value": "12288:aw35dS4X8AnVqWEEy+AvEYJ0M6v1PwDDoZ6A1MRh:735dPpyEy+4jSvlw32E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775483, "uuid": "1cad7ff7-356a-462b-8299-9df804ebc013", "value": 462371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775483, "uuid": "8144c7e7-8b36-4e7f-b7f6-d9b1868797a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775483, "uuid": "9630eb02-8409-4ce3-8533-a0e1be4e47b8", "value": "Updated_Price_list.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca70857-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638760436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760436, "uuid": "520d09e8-333e-471e-90cb-db3e95f70a89", "comment": "Malware payload", "value": "91235219c566947ef55b7fd79b9e0ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760436, "uuid": "bdb51786-c0c9-4cf4-9ff9-5ee7fea52b6a", "comment": "Malware payload", "value": "5f081c3bbf0274f3e61e1e1b472c2c52856a08a622514760e76e31fe05660592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760436, "uuid": "5e51531f-b5b3-4abf-ba64-b1d01a1ef26c", "comment": "Malware payload", "value": "8f28cd623e78baa7c08315397888299dd32d3e56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760436, "uuid": "9bc22f44-9522-46a1-a895-74c4c0609323", "comment": "Malware payload", "value": "2bf5703a6f843f1565ef726117bf35f76509b2ed0325e65c88e27e2aa24e63c56f450157880da9ad3b5f7137b38d244f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760436, "uuid": "3a41c9ad-6253-42bd-afd3-22112e66bdb6", "value": "T165735C337E5780B1E55092B1383967B681B9D525AB3316D7B3885F3A8A101F33E72C7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760436, "uuid": "1b07f3ef-9229-4a6d-ae9b-efccc290ecdc", "value": "2d1b769ca78dba0b606ea181439d83ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760436, "uuid": "c3bf3edc-302e-4ac7-aa4c-7273e6b39b71", "value": "1536:bBrtzFPwiPV7YRFOVlJibgZHSnr3nSvLe02NaH3yGHnkeAm03H:RwiPmnr3NaH3yGHkeAmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760436, "uuid": "4c2f1637-1dd5-4010-a317-dcad3f11c85f", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760436, "uuid": "a13fdf24-b5c6-48e9-b224-210d4a3d72ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760436, "uuid": "b8c17757-94e7-44e1-9219-7b8239b6a8b5", "value": "SecuriteInfo.com.Trojan.MulDrop19.10627.27890.10705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93ffea7-5693-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638795300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795300, "uuid": "4b48217d-4f18-4673-8d84-4adfb275ff14", "comment": "Malware payload (Formbook)", "value": "b3fd22b2f3769ed623fa28e70bf5328e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795300, "uuid": "9f74ccda-06b8-4113-bc55-a340549cac44", "comment": "Malware payload (Formbook)", "value": "5f41c8e6da11a0b75eea8b9de304fe54da16779c6e1046c3c0bea59b1b695061", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795300, "uuid": "98963e8f-e5ab-4de3-a2e9-2cad3fe14701", "comment": "Malware payload (Formbook)", "value": "81c1c2f7dd726f58c546fb95f8cf963d6a4908db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795300, "uuid": "4aa6a0b8-2a3f-4c9a-973d-d251e61c8723", "comment": "Malware payload (Formbook)", "value": "355b9a2880caf0127e7c1bc415006955d3e96650217be55282164797b6346cd807bbfecfeb512dcc9f3c70324c693e3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795300, "uuid": "4ace67e3-62b2-4959-8368-82a794fc85e6", "value": "T1DA7423070A809B7BC86F26700F79E339F3B589EC466F8A1F2B744FBA59F69015411663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795300, "uuid": "5ac8cc9c-8c77-458c-8f8b-13359efdaadc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795300, "uuid": "3bd69990-d4c0-4f20-beb2-bb68953abe99", "value": "6144:rGirsHL2Nkd/64kHK0bM1k7ZNkGTh0hPlWkWNmeXuUVHt90XcLIuabxO49eDDeG4:vsLtZ6pU1k7ZNkG90h4kW4eXdVHnqcL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795300, "uuid": "b11a7d47-05e6-47b0-bacf-40dd288d170b", "value": 360547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795300, "uuid": "e01590e7-80f7-48a5-980c-9bdae1f2bb7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795300, "uuid": "a4f2d3a3-1264-40ed-93f4-3996d7c611c6", "value": "b3fd22b2f3769ed623fa28e70bf5328e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6cf630-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638802445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802445, "uuid": "3a52f3fe-a50b-4653-b7a1-1e38c9bddf62", "comment": "Malware payload (Formbook)", "value": "f9712132cd459df2f26fc073a20ea0e1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802445, "uuid": "812179e8-09a8-475d-afa6-1610b409e0ec", "comment": "Malware payload (Formbook)", "value": "6164b13a1815b609090b01da7225e44da3448707cbc13edd7cdb56cfd9f65dd4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802445, "uuid": "f08e4640-53ea-4638-ab39-a864c009fdd0", "comment": "Malware payload (Formbook)", "value": "1aed332c12f00b4388e3e531df22f6c37502b0d8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802445, "uuid": "97b8e7a9-b38d-42fd-9d8e-fed31bb3f326", "comment": "Malware payload (Formbook)", "value": "47bc88ddc6df87794c3ea573246940d092a2702da1afa011447e864729d2b386bd6154c17baa49f74f8b20b9bfb2771e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802445, "uuid": "a17ac189-9401-4fc3-86ed-5dda230fd077", "value": "T16FC412A07258C36CCAA5A9714070091216F76E4728B0D34DB2ED781D6FF37C661B9BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802445, "uuid": "2f59ff66-873a-4dd4-98c9-54aa1719c750", "value": "12288:fpYcrq3cPewn+n7TOK4wuZuKYPDy1a84haHKy1:fpYcrbRo7X4XZXyDy16aHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802445, "uuid": "957b2a9a-8295-43fb-b0cb-e835c2e30fe8", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802445, "uuid": "6477f984-1928-4ce5-94ed-cfed229af32e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802445, "uuid": "e21e2217-0084-45d1-a2dc-0dda32efef6b", "value": "DHL Express shipping documents - 2930 November 2021!!,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c417b6-56a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638800746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800746, "uuid": "9677d2b4-72f5-41f4-bbe6-48bd37015ecf", "comment": "Malware payload (Dridex)", "value": "e5bade4e23d68eda8187f26b17a6b550", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800746, "uuid": "5701b149-608b-4ae4-b75c-0fd9a02d5bbb", "comment": "Malware payload (Dridex)", "value": "618f667994e6c2947c6d3c646cc9ae264b9111f768625cbde00b155fa9d4e9f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800746, "uuid": "6a27ae9f-1802-4db3-9fd1-109d6d07fa27", "comment": "Malware payload (Dridex)", "value": "61036013f1921c02d5ae3cdef5a696dc964baefd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800746, "uuid": "785c9418-77c5-4578-93cc-71a8710e85e2", "comment": "Malware payload (Dridex)", "value": "d527abfff5e88ce807b35dc1dc57a62c8ebb5d542a80d8e240b40940229245907e9a07ab952e5907215ffb7dc5d076b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800746, "uuid": "f307a8c0-5a92-40f9-ad83-c633eccd8b22", "value": "T167A4A0469916A00DE80DA43DB34CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800746, "uuid": "5a68f326-ef5d-49a8-8bd6-9f64e9919cca", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800746, "uuid": "3121c1ac-ffaa-4495-a6fb-f0264242d7ac", "value": "12288:j7fimEsIsmY4K08oM1Wd8t5KQhNdv5zH:j7aVRBn7x6jt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800746, "uuid": "c2956f04-6f32-44ff-a675-94a3e2f19222", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800746, "uuid": "9fe7d8c6-f2ab-4597-8e27-5ae4ee5ca656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800746, "uuid": "57223eb0-e5a4-4974-8b5f-4401acda8962", "value": "e5bade4e23d68eda8187f26b17a6b550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df98f91-5668-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638776760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776760, "uuid": "0985f132-7641-49e7-9189-925651f1ef15", "comment": "Malware payload (Loki)", "value": "eefd828bc367444b4b93d6700229e686", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776760, "uuid": "c49381fa-7532-4745-b62f-450c61a7ba9c", "comment": "Malware payload (Loki)", "value": "626c13c1c0c0b6a85a2cf4ec10a53bc7a01ca360e376db49eae71a5b3a3ffb7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776760, "uuid": "e88f97b5-47f2-41d2-9414-e94ca8c7f715", "comment": "Malware payload (Loki)", "value": "9ef7c4c1290e1a2494b9d807e0783ac123777d67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776760, "uuid": "9c9dc5fa-395b-4b90-a4d4-3c91fd18d31e", "comment": "Malware payload (Loki)", "value": "de461127c1192fa6ceaae0cd5e769ae3ffe5f9e2c02aad3d3abcba862a2e952cff8768566728a71adf590299dfbf898f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776760, "uuid": "9bc4e875-923a-45f8-a6f3-17f224dd235b", "value": "T139A31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776760, "uuid": "49b3c009-172a-41fe-b51c-837bf9fb4633", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776760, "uuid": "1d8dfa46-ee1c-4555-bbe3-396df22d9307", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776760, "uuid": "e4d35a3b-66a3-443b-ae45-c202c555a217", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776760, "uuid": "4f7d8ef4-89a3-4cd6-9c21-2bce6caa0690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776760, "uuid": "2a98a033-b17e-4b3e-b2e9-dc5511823167", "value": "eefd828bc367444b4b93d6700229e686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002f6acd-567e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638785971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785971, "uuid": "554112ac-7eea-4dc3-a715-caa6e2599e57", "comment": "Malware payload (AgentTesla)", "value": "0bff8211938865b4e05fbebe9e9e8cd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785971, "uuid": "ef7f1dc2-e01c-4be2-893f-f08e897b007d", "comment": "Malware payload (AgentTesla)", "value": "6396d3ab73f8d976d77be6c7911098735b9f10b89bf826279fb8c08265fc6178", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785971, "uuid": "86e977a0-0eb1-4a35-a2ff-32c343e0bf80", "comment": "Malware payload (AgentTesla)", "value": "92333a88e0e27261b417e2c4ed51e6cce942d39b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785971, "uuid": "45e6df3c-6138-4f92-aea7-2749a98b9189", "comment": "Malware payload (AgentTesla)", "value": "1802878591a15ff2126c946eba012cfac2594fb1e58f046e01e232945e41954d10c93ca6570ffea9b6a058c5d1899b5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785971, "uuid": "b4c47770-f759-40b7-9a7e-c7044dd35acd", "value": "T113657A1C21B5486BE97D1A35142107774EF26C3D99B7E3CE3B48356B0BB36844B263EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785971, "uuid": "a406b4e7-d13b-453e-9538-d81001403bbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785971, "uuid": "1ce8b41a-df77-4195-8f39-503194c2093d", "value": "24576:pDbPlyaik8u8vobaNXHJj3ZtUm6uvAtd/7hl28BBszIvWAXVD0vfSLl:th8tv5Hh3Zt2uoPDUIZkSLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638785971, "uuid": "dae3f59f-cf24-42d3-a7d1-ac0d44acd13d", "value": 1413120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638785971, "uuid": "f9bf4530-f672-41a9-8dad-0f7f10d690ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785971, "uuid": "677bfeb8-1e28-47af-9b52-476f8dc16ab2", "value": "NEW QUOTATION REQUEST 0612202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740f3eba-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638802486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802486, "uuid": "b3a92118-cd1a-4598-8869-fbfb112022d3", "comment": "Malware payload", "value": "e0f83cb15d7f04744a5947191e7f3a38", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802486, "uuid": "9cc69d5f-afcc-4a55-9775-27f17d4d67b7", "comment": "Malware payload", "value": "63a5e8907fc76bce1cc14fe341371b74a1f79d38beeda945229e0d968e34ac0e", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802486, "uuid": "6efecd9c-5bf5-4f13-bbb6-c5353f176b80", "comment": "Malware payload", "value": "170c260c550b3d95369b7ad430e6e23f8fafe873", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802486, "uuid": "bf60a7d4-d0ae-4592-9b62-6d13bbd08b48", "comment": "Malware payload", "value": "001f2907eb414799db1c0bf78d30bb3239d2add3da9cc8d0c8588ec1bf565326f7afdcf9b0cfa56186ce4b39c6a6f81e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802486, "uuid": "93d58a10-dbfd-4a20-a913-1c3531ee0b37", "value": "T162454AD2E284D98DC41B02B7CC3AD9716417AEAE4574861E246E7D2B76F7383206BD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802486, "uuid": "b4dd3774-3a92-45ec-8f60-75c2e38f35fb", "value": "6144:CORGGGGGGGGGGxGwCpb/OAALo5GGGGGGGGGGbGGGGGGGGGGhGG/DGXxvXJG85Pm/:CYoK/O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802486, "uuid": "559259dd-5afd-436a-a879-ed511d4074dc", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802486, "uuid": "9987c37a-83b9-4f7c-a3d8-99060b62afef", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802486, "uuid": "97790ad3-0a0f-4f96-83c8-da5c8eec2eea", "value": "Odeme.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee064bd-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638765084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765084, "uuid": "1b7b72ff-0ecc-4b0f-b45e-0b6eab8ebe16", "comment": "Malware payload (RedLineStealer)", "value": "fb586b4d8d22398682803bd59487b4f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765084, "uuid": "5793eba7-1f0b-4704-a88a-6986ca429d4f", "comment": "Malware payload (RedLineStealer)", "value": "641b85bc8e773d25f0cee23a207a6aadcfae1d534cadf5e2f0ac93e6fc3f4769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765084, "uuid": "89dcc56d-920b-4522-9e90-2997e5e8ca42", "comment": "Malware payload (RedLineStealer)", "value": "92a11ba1115f19e97ef89f5d1b88a9c4506b7987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765084, "uuid": "e95774ba-e24f-4f29-a0f6-23f4eecf7643", "comment": "Malware payload (RedLineStealer)", "value": "7f0340132f8cd19ddc9d9a78adb5b229e6b69286332aff85a75ed5c99745f886b8726887e99fa10d461ec6a405c0b518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765084, "uuid": "e521347a-a6a4-4014-a564-38e71ae3deea", "value": "T176753385C39C794CD7AEE9B4D80F78189AE9C1517CEA94F2333518C32E7A4293129B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765084, "uuid": "b21b5ddd-6766-4b7e-b021-57e9e6b98320", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765084, "uuid": "c71b2cd6-65a2-4f28-ba3a-b12ed3241e1b", "value": "49152:fKiM4PG2iuedj1qwF/ws6z/YuMV56NaEU6NVc:fl5ded/DbuM3m32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765084, "uuid": "93aad380-f6a9-477a-9192-be5fb954d0ec", "value": 1658584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765084, "uuid": "a9d4759e-9d0c-4341-bba4-df7bd119599c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765084, "uuid": "f004f8e2-57d1-4b0e-9d7d-d832cda0f794", "value": "SecuriteInfo.com.Trojan.Siggen15.59581.9759.31934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da5d5f9-567c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638785322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785322, "uuid": "d81418cf-4b6b-49ec-ba7e-6a07b2580a08", "comment": "Malware payload (Heodo)", "value": "e398fd37610cfc889775aa1bd7037079", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785322, "uuid": "6cf859e7-555b-4d2c-93f6-4fd368f55595", "comment": "Malware payload (Heodo)", "value": "642c782d7d127f20635447a54de2d9adf1c6cbd0a6985cf16afed7d58a8bedec", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785322, "uuid": "6c5590de-7ba8-4e87-a6c5-d6ac82136262", "comment": "Malware payload (Heodo)", "value": "0770d97fad886fcd78e627aa37699fc9b7d32a0b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785322, "uuid": "9038f29f-9d76-47a8-b666-4646eb54b16f", "comment": "Malware payload (Heodo)", "value": "0dfdc9b958bb156842cb906daacee2c6e552eecf30e263aa9c9e62a2532aebe2a41c2f6921d9c774a56e1c56f35f3ce1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785322, "uuid": "71f83f35-13b1-4181-92e4-747d98042eb6", "value": "T19203CF2DC2526858C736A83EC10884DEA55C2C576041FD1F1594B38D2B7A5FB2B9F2FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785322, "uuid": "b9e084e4-091a-4155-b8b9-43e725f214ce", "value": "768:Q/Mvd5dhTkYME7l0VGpevZCw4ZmUxjfC30+kS4Qyot0VIyBgr:Qmd5cnE7WyXYk4pmVIyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638785322, "uuid": "779c19a2-af21-4caf-b57a-7b7054cf4b07", "value": 39100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638785322, "uuid": "0954c273-2bba-4bbb-9b0e-b5f03676d9d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785322, "uuid": "86e57540-5fa8-476a-9e2b-cf02acba2453", "value": "Dettagli_7251.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f02dc73-56e2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638829026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829026, "uuid": "45e34960-1de7-4718-b83d-7db6e9d92f5a", "comment": "Malware payload", "value": "dc66f61ae6372f2d80aaa8e1d437532f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829026, "uuid": "97b0e5c8-96fa-423d-83d4-0e5e691d791e", "comment": "Malware payload", "value": "646b7c888c54221556f191a77f9b3fc4a0c577d6dce5c32aba5c784cb1053f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829026, "uuid": "a8ca776c-5ad9-4d3d-bab7-64f49da99f40", "comment": "Malware payload", "value": "d319cdb91011ba6b7d7b397be1e5f9d2c4a4f72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829026, "uuid": "9cb9c200-e225-4b0a-a1bc-6559a510f1bb", "comment": "Malware payload", "value": "23b2ea748a0a037e4c11a914f67b694d754154804df3353ed6913a1eb8815b7338ed98a8d8faeba0a5106f93a49a4e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829026, "uuid": "3dfd8141-6bf1-4f4d-8ab5-bfe878841738", "value": "T155C4E1B7794B5788C4A004306C02C2BC91B7BD97E0965472BF7EBF5AA739294CBC6835", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829026, "uuid": "5c80feaf-03b3-4ecc-bc53-05e1d9c0e227", "value": "2ba1d8c6f3b21cc24700c57eaf036d66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829026, "uuid": "69988d9b-48fa-46c2-8e75-f3b0cd4222a6", "value": "12288:/U8U8U8U8U8U8UOt9YwN+DX//v4py8XyvUVVCn6:/U8U8U8U8U8U8UOOwNYf4vnVVCn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638829026, "uuid": "6347c576-a5ac-4f9d-b1de-2662a7dd4e97", "value": 571840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638829026, "uuid": "6c51bbef-bef6-42c8-a4bf-0d8cdf07aabf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829026, "uuid": "94c6e14c-9abd-40f1-9bf3-e81d4f7685dd", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037d36ea-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638772232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772232, "uuid": "5c339dfd-a8ef-450a-bb66-114f2f1cc1c4", "comment": "Malware payload (SnakeKeylogger)", "value": "dd373ae45da1d4f797f38e2e356d329f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772232, "uuid": "de0acdfa-200c-49ac-845f-e8905e14b8a7", "comment": "Malware payload (SnakeKeylogger)", "value": "646ff740a579fad8c98875763bc0fc06335a88b922cdfd25b71b7e12cc0460f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772232, "uuid": "ecce33d6-08e0-439c-b13a-01473c38cb02", "comment": "Malware payload (SnakeKeylogger)", "value": "38efe558e2c1e721543f07e84bc8e0445b96d633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772232, "uuid": "9b5214d0-7a74-49ae-ba09-bb4df0b41b61", "comment": "Malware payload (SnakeKeylogger)", "value": "f3509b0af4f03959e98cdc16f3efa60697723b2920213cc4383bdd399dbb47a9ef6c3eabf1bdb8b2a49ab7f3a877cce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772232, "uuid": "f92b3b0d-947d-4a3b-8981-3bbb48d66e6c", "value": "T1E255682C21B5086BE97C1A35042507778EF26C7D997BE3CD3788356B4BB26840B267ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772232, "uuid": "6d4af18f-9957-4907-acbb-cb2188069db6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772232, "uuid": "f24539fa-fa0a-4f7f-a57d-42bd64436501", "value": "24576:Os90Vf9DqjpWlU1+KevTHiZsg+Uu7w5EoL+:y2pw6+KoTHicp7w5NL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772232, "uuid": "e0d76eb5-af1c-45f3-acb6-6338981b3dd8", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772232, "uuid": "fa2f2d8e-9c9b-45db-921f-0f81dac79ff1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772232, "uuid": "aa93112c-84ab-4ce1-a697-dca394e3120a", "value": "SCANCOPY3892783-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8c1e3f-56bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638812244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812244, "uuid": "9cd29190-ac14-4980-9a27-972609d8a9ca", "comment": "Malware payload (RedLineStealer)", "value": "601a337f1092a3da88bb81672e6f554c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812244, "uuid": "f62c1904-a7f0-4d9d-9880-0848a3a4fdae", "comment": "Malware payload (RedLineStealer)", "value": "652d426c966ce5b82149b86593f0b8224044796ca670c0c80036aea58d343343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812244, "uuid": "42b33461-e417-4f32-8013-ea32dec1375f", "comment": "Malware payload (RedLineStealer)", "value": "b7c95959b8fd7c71e9964a1e7db75aa4384ac621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812244, "uuid": "636602be-d6ab-42df-aa15-d87e3370d67a", "comment": "Malware payload (RedLineStealer)", "value": "1308ae6ba9cef94e9442dec6916458619af745263d9a7253a3dfa1fde3f273f50cce8bc939bbec92a16a0d1294f23877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812244, "uuid": "ea90c7c3-e49f-4f0e-92c7-a7e16cacebea", "value": "T1E7E4F11272C0C072D15615B68625C7B48EBAF4720B267ACBBBC46BBD5F7C7C2672530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812244, "uuid": "2a1bb8a7-83ac-4d77-89b6-d01d8aebd204", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812244, "uuid": "8e6557c5-ea39-4fd4-b9f5-1c6233dd52a4", "value": "12288:/L/lqpDQUeUMI41CVT4d8G/OwbsZhnfch5S2RQ1tDtvhySeIuhuZ7vC:/DlqpDQ0btA8G/OwYkRGBhDethWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812244, "uuid": "27968dac-2ff9-481f-858f-bb4eedf09889", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812244, "uuid": "0bc87a72-df3e-40bc-a1fe-df844a96c662", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812244, "uuid": "81557408-6bb5-49f5-80f6-967705d19c30", "value": "601a337f1092a3da88bb81672e6f554c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0265e51b-56c4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638816039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816039, "uuid": "e2f0b74a-c6e1-44c4-9d07-162eaa0aed8c", "comment": "Malware payload (Dridex)", "value": "02116f0284776240bbfc01174606a4cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816039, "uuid": "3052c351-84cd-4f32-81d7-63ad6934a213", "comment": "Malware payload (Dridex)", "value": "660a49b28334de1ba4d59353a4c310501d6f3f9290b17ef6e3e3d4b6e7bc34c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816039, "uuid": "e12878e2-b09e-43b3-93fb-7f7af123be10", "comment": "Malware payload (Dridex)", "value": "8a454864fd7d6b6f9e7d1e83ea7e8c545f101cab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816039, "uuid": "c5dfc57d-1ce9-4a46-ad25-b6c9c20bfcd4", "comment": "Malware payload (Dridex)", "value": "b6a4fe8f9556c4d295a1cff2d76521c5b5f442c082a1d814108c92b3e0f6648805886655fc92f1377b75728367585ee4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816039, "uuid": "d0a226d6-d0f9-4046-bbf9-a8ec0ec641e8", "value": "T1CBC31298CD315C68C4A7E4F96F8E066793E580227301B48F2E9774BC59E221F6B49BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816039, "uuid": "75ea2f69-c8a8-477b-958a-85782fe758db", "value": "3072:ovtqLqZSx5rAZhFBQdjDEcvQwhelhlKs1edw1:ovtEyEsZhF+JDEcvedjsdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638816039, "uuid": "210e7866-9ef4-4e23-88b2-0c7dc124bb62", "value": 126347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638816039, "uuid": "042b2b1e-ab0f-40b0-9163-4d8ec99cd5be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816039, "uuid": "b596f0f7-631a-4147-8ead-094c6310bd26", "value": "insurance updates8595847130.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2b280e-569f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638800219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800219, "uuid": "10d430a5-4c87-425b-9e36-0dc44dc65587", "comment": "Malware payload", "value": "d9ae9bcc7729b767a0252341e866cf3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800219, "uuid": "07749b59-546c-497c-91b7-849e2fb5ba47", "comment": "Malware payload", "value": "665b57f11deb2243165503b3e3cd8c21e0c82aca11484c187e89683a3bcde912", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800219, "uuid": "3e12de47-6f46-4cbb-8da2-06bc884ded30", "comment": "Malware payload", "value": "869ada0392bfa43b41140db78f1de4419613ed45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800219, "uuid": "35ae7f9b-bb43-419b-800c-80e0e7443153", "comment": "Malware payload", "value": "dca03be0af663c37cc348ac44ca7f0dedace4aad182fc3d89d7cd907ed5b9970eefdd4c042ffbe3be956f7f779a82eef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800219, "uuid": "5b099b81-8460-4304-9dc5-bda1116424e9", "value": "T1351127866F997DF1D02C3376124F841671307C3056D78A6728CC162521C57CCA817E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800219, "uuid": "70709fb2-d7a8-4dff-8fec-21ba3a459687", "value": "6:idqixSVg3F+X32VPrPaSOhWrb0rjrofWYTRJBKRmTRoRVplWsZyolHvksUCvdIUC:epxSGSGFrB0To++JCAoViUlH5vdIBHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800219, "uuid": "e72d2931-36bd-4d14-9882-cdfa0f088d73", "value": 926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800219, "uuid": "6207a2a6-be14-4a4d-835f-44922ca8ea8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800219, "uuid": "bbda4300-c71e-4780-9e8a-1c55914009e1", "value": "emotet_exe_e5_665b57f11deb2243165503b3e3cd8c21e0c82aca11484c187e89683a3bcde912_2021-12-06__141656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848824bc-5678-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638783616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783616, "uuid": "4049eefe-cbc0-4447-b95e-080611faaf9f", "comment": "Malware payload (AgentTesla)", "value": "c799055be57f742dfc306ead59eeeb75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783616, "uuid": "b829107f-1ef4-4eae-89f1-bf51bdcca1ae", "comment": "Malware payload (AgentTesla)", "value": "67cb506da7e0fb7f45aa41396d76b145b2ccd25e77bc7d3a01050facfe965d3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783616, "uuid": "48016809-c13f-420f-890c-b2c284ee7405", "comment": "Malware payload (AgentTesla)", "value": "031ccdfd90ec7be8c6772edf0b6b8dd4b3ea2006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783616, "uuid": "fb0030e0-4310-40b4-aa15-1cd064dd5575", "comment": "Malware payload (AgentTesla)", "value": "cbcace001f4e23000eba79676074f1078a7672fe7c5d54cca4774feb605ad0aa9914748c5fda34c2767cc2e35ec44cc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783616, "uuid": "7cb90fd2-aa65-404b-a38d-4ab79f69c535", "value": "T16E556A5C317025AFE83A853145540F3B9EF12C7E962B53CE7317346B8ABD9868F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783616, "uuid": "7104651a-96d3-47c9-b012-d6b76a2ebb6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783616, "uuid": "a8baa4fb-1126-4d6e-be25-9ad8e15d6288", "value": "24576:IV71jnOL1NujLuitvAn5tYz0jgatvn/A4/Hd3YeU5lsnK:aJjOL1cuiG/ZtZ9UQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638783616, "uuid": "3af7ac3f-9894-4e3d-b5b8-764805315f9c", "value": 1405952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638783616, "uuid": "e926196d-051e-454e-862d-747945d92ab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783616, "uuid": "51b68075-4f60-4e0e-8c0c-0738fcb9b968", "value": "Invoice #763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0410cc90-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638811747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811747, "uuid": "1834e963-cc71-4a2d-99b4-840d919f40c4", "comment": "Malware payload (Loki)", "value": "0fba6afb19495cba62963b857eee6fc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811747, "uuid": "93d3641e-a6e1-4c02-8441-0de46ebfdc4e", "comment": "Malware payload (Loki)", "value": "68d5f38cf9d5f63d9d59335905a5576ff8820fd26d3d4844641fcb6ab9e56170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811747, "uuid": "91a4041d-4a51-40a8-a139-17f019740864", "comment": "Malware payload (Loki)", "value": "5ad0f82cf536388a812c3441349c99d5602ed46e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811747, "uuid": "56a9bf0f-b281-418d-9e39-43b6719445fa", "comment": "Malware payload (Loki)", "value": "7c040558ceda34e2d5a75ecac8a7764d6dc350cd4c668bd3554850876907ce801b90594838622446b8fe9de5f5223718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811747, "uuid": "a8175cfa-6e5b-4dcd-a7a1-ffebc66be892", "value": "T13745495C317025AFE83A853189540F3B9EF12C7D926B53CE7317346B8ABE5468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811747, "uuid": "2df62d5d-baec-4ed5-8d1f-b62c049e271d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811747, "uuid": "a6908bd8-6b4f-46d7-b990-88170ee418d8", "value": "24576:Ym4rqvLRKB1quIXmJOyjIXIi2Gm+A6pXCVfoB+Fjg/:56qvLRo1qmJBjIn2X+dpXKfC+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811747, "uuid": "5b4636c2-8229-4b9d-9ecf-8c1daf979a87", "value": 1226240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811747, "uuid": "d9023181-b803-4a80-9c3d-7336cecd969a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811747, "uuid": "dd3c57a8-9749-4d8a-bdf1-f9864ccd2244", "value": "0fba6afb19495cba62963b857eee6fc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb128bc4-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638789827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789827, "uuid": "37052f81-7f05-4fe5-aa56-590a8fd46d43", "comment": "Malware payload (Heodo)", "value": "287015e41a91dd783c686a6e7b8e1a10", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789827, "uuid": "33fb389f-b28e-45d2-80fa-9353dac3fe24", "comment": "Malware payload (Heodo)", "value": "692564f409e64804b5311bdfa3dda0f795b02353daa7b23c094bfe71597da0f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789827, "uuid": "a5b3d27f-caee-45f7-b5ed-8dd2f9b6a5b5", "comment": "Malware payload (Heodo)", "value": "09faffeafa6c7ae9f71d55c55490399cae246d3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789827, "uuid": "71206493-21b1-49c4-be6b-07ca86c926b6", "comment": "Malware payload (Heodo)", "value": "029a80acd6b478928a67752f5041e0c0d58c3ae2376f6f0bacde7d99a4a8fc47ea3de56c3291946a16a4046c40e7c867", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789827, "uuid": "88bd637f-096b-450e-8655-25128252a116", "value": "T163F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789827, "uuid": "bf8e49c7-2069-420b-8d46-032f6a16a84b", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789827, "uuid": "b71b9543-0610-4a22-bf44-fc40c930a609", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/c:JapiKiBEmj4GbOX399Md9J/0Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789827, "uuid": "c89d132b-6918-4884-a9d0-1f2912a41b78", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789827, "uuid": "190df9aa-6e52-4f25-9be5-bf318ef61156", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789827, "uuid": "4a3e1eec-e701-44e7-901f-f9da7bcdb200", "value": "y2Gso.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82174f89-5698-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638797355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797355, "uuid": "3eac2fae-a451-4ba0-96aa-1093d5b19db8", "comment": "Malware payload (Formbook)", "value": "c8daa408a583480ec0d826fef6c9945b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797355, "uuid": "268877d0-a729-4633-be27-806fe5fc8b2b", "comment": "Malware payload (Formbook)", "value": "6a429876cbcc77bcf631c59404fb56765fe6668738577e6cc0ca9274dd810ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797355, "uuid": "78a9061a-95d4-45f5-b765-e22f8b00496f", "comment": "Malware payload (Formbook)", "value": "a39236494f5a19c9c23d89cb638cc0dae8ef5c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797355, "uuid": "2b1c7444-e3e9-46b2-9f07-f906e58706be", "comment": "Malware payload (Formbook)", "value": "7462244d6d87764839d94720dd58f61d8a5e67ee02d8af185a88bf2d3df1799a708a3d28733b15224eb237a9039dbcee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797355, "uuid": "8a2694e4-bc3f-44dd-8dbf-29acb1e51c62", "value": "T1E074233A30D72E77C769593244FE9AB8F3FD167446A2141F07842FDD19B24A7E18C682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797355, "uuid": "24f3d3e1-934d-4d5e-bb88-77040159cc1c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797355, "uuid": "d161112c-a43d-4284-b54b-ba1af3ed0646", "value": "6144:rGi0mW2nAKg0du+TROB6hzsSLxW1f19YLc83CHss4Dh28vtFM:4mpAj00cROS5FYrYbs4VrtFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797355, "uuid": "49b39e03-51e8-4b16-8156-3d02dbb1bd78", "value": 360856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797355, "uuid": "04453b8e-1d20-475d-a045-464114cc5281", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797355, "uuid": "dfdd4a32-a7b0-404b-aaa2-a91b394647b4", "value": "c8daa408a583480ec0d826fef6c9945b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007e473f-5699-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1638797567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797567, "uuid": "2494ef40-6fa7-4c1a-8df0-1e15e6e365b7", "comment": "Malware payload (Quakbot)", "value": "6c81e5cde9414a83dd257e5a173e18b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797567, "uuid": "e1775c4a-0681-4f9e-9e55-f1bbfb43cb43", "comment": "Malware payload (Quakbot)", "value": "6ad42c31b49e95db94c513c977b05bf44683c915bdac88092459e58de6ed2744", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797567, "uuid": "ec1a9c6c-5b38-4946-bbc1-d26758e9a315", "comment": "Malware payload (Quakbot)", "value": "0ebc8b6de585016cbdee5449e212c271f5e947c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797567, "uuid": "93ead9fe-b283-4f05-a1a5-770083ce159c", "comment": "Malware payload (Quakbot)", "value": "a76d8a750ac5b534dbd3d83e81807bbe436575dae0518f81b54f2c194c93a4e1843562978b10125a3d717d0e00b30463", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797567, "uuid": "d75e2359-6e41-422f-bd62-d59b7a457391", "value": "T13183BE1E9725A42DE3992839930548F5A28902A3FA00F40F1FA7B7611BF59D7F7BD09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797567, "uuid": "65fa143e-959b-46bf-b64f-b06916c34d02", "value": "1536:ucuOKmMH2gMyhmw7AhhDnp+hz/Ck3myG7lZZZZZZZZZZZZZZZZZZJ9:jlK9MCmw7AfbpKr329", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797567, "uuid": "80389f16-ba10-4172-abb7-f1bd5a630df2", "value": 81869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797567, "uuid": "3c030ba7-c91d-4f47-9076-ce35bb6f7c16", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797567, "uuid": "eeb1dadf-ae28-4632-bddc-4feaaffac0cc", "value": "6c81e5cde9414a83dd257e5a173e18b1.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367e3418-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638775324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775324, "uuid": "23232588-5760-49e8-8697-21b18feed1f0", "comment": "Malware payload (Formbook)", "value": "f3a684006ee2805b54883a5b3d8a2e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775324, "uuid": "8b6921e4-d305-4f80-9ee3-da79a0a671c9", "comment": "Malware payload (Formbook)", "value": "6b1eaa84393877f4e3ecf99eed62c76eee694b8c765b074d4f1456b54907fb63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775324, "uuid": "cae75377-9684-4b74-a631-4939cafbfd9c", "comment": "Malware payload (Formbook)", "value": "8927588843a60cfc9008f8e10cb8e43100fbf3d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775324, "uuid": "5a723ef4-c367-4472-9a1c-62dac893b680", "comment": "Malware payload (Formbook)", "value": "3090009c3134449f839bafe73a88925992900b623b162316ffbcebdffa403413d9a76435bc048adc98d6c7d4c1a24178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775324, "uuid": "d331ffb1-a570-4b94-8a3c-d89f955be13e", "value": "T10255595C317024AFE83A853149540F379EF12C7D866B93CE7217346F9ABD9868F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775324, "uuid": "a8274687-a158-419c-b40e-2d8c71b12dfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775324, "uuid": "d08350c4-9f7e-4d3f-8266-c6475aa0cb31", "value": "24576:aCJLHEfJ+LfDH8INnwXBU1uug+fwzvKFjRzzO9d8Enq6+:xLkf0L7H9nwXBUFwjKFjXEq6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775324, "uuid": "755f123a-d484-4dff-881b-bb5bd261560c", "value": 1348096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775324, "uuid": "a1138ba6-a487-4e92-9f55-1cf55323c108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775324, "uuid": "0f15264a-dbaa-4060-964e-574de5cbde71", "value": "\u0130\u015fleminizin detaylar\u0131 ektedir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f104e2-56bf-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638814030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814030, "uuid": "ac8581cd-b1c9-4321-b961-fdeea5ea3f32", "comment": "Malware payload (RedLineStealer)", "value": "aa47323a9896ed573ea4d19590d5d5b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814030, "uuid": "2be22540-96f7-4afa-abfb-a2b9ce904b66", "comment": "Malware payload (RedLineStealer)", "value": "6bf60ca958226f76db428f623f325cd79a37c0cd14651c838da0be13659bb5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814030, "uuid": "8ac60ec4-7777-47b6-9078-9b85e43aad7a", "comment": "Malware payload (RedLineStealer)", "value": "44fe5974c8827b94d71f3a9ccc85ffcddaf1ee0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814030, "uuid": "ab7069da-a2d1-4d50-8c50-42e73fcd9633", "comment": "Malware payload (RedLineStealer)", "value": "5876b00cdb374ea5e8f91ef6e01572ed78e453a75eb1b464f0463c51c313804c24e5d203a621ce5358072ca953de70a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814030, "uuid": "4d248860-b98a-48de-8455-f40d489ac907", "value": "T12C8533570B68B41CC3588E7408609DBD700C4E15B962A6ADD7E728EA937F0A3BF47CC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814030, "uuid": "34497903-936a-48d2-b5a7-70b3bbf6d121", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814030, "uuid": "88defcb9-8d12-4208-a86c-bc84c0d80aa7", "value": "49152:Ts1kXCUxwtc5194o7hziu3JsTHNaZCTlPv:g5Uxd53R5b5sTtsA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638814030, "uuid": "346d5906-15e2-4d11-877e-de12cf23fa0b", "value": 1758208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638814030, "uuid": "65b39f44-d8df-435d-9314-264c9afb522d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814030, "uuid": "caf211fc-9fdb-4434-b006-981a6a5252f0", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a59ace-56ae-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638806913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806913, "uuid": "13a35c44-68d3-4107-9ef9-316db2a7512b", "comment": "Malware payload (Formbook)", "value": "5509299f8797fe1c6635d895222d978f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806913, "uuid": "adcab8bd-650f-4c55-80e1-b28d7482ad2f", "comment": "Malware payload (Formbook)", "value": "6c62f6c80cf4e6915c3c604b9d8179d9f9e627405333174a15ee4d06e98d214d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806913, "uuid": "42348d22-8db9-414e-b02c-ce75b8ceaa85", "comment": "Malware payload (Formbook)", "value": "4d8e61f1c4f56c8f15669def9a752d2d616cfb07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806913, "uuid": "70fd20f8-9e20-42ba-8c82-bf69305e45b6", "comment": "Malware payload (Formbook)", "value": "d80b21ae80a3e5b105afd7c0ee912844a02807eea1d042b030fb33bb9fd987af08dda6f51a0dd2dd5d3af732ba3e55a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806913, "uuid": "715c094c-cbd6-4e9f-89fb-0ca0e48fd487", "value": "T1C745D01926E94D9BF9790B70182156325AF3AC2995B7E78D3B4D311F0BF378009327BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806913, "uuid": "3fdb5d18-8cf1-4efe-9bb6-bd5ac11b307a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806913, "uuid": "c9db9803-7462-4f3c-93ee-bb36322073db", "value": "24576:x/H9mWGL+mJxYd7VzptG9aTJLSKO0JDPK7H74Glavl2NLaCkNPUwYR1hEliTucGX:mz7+ppt0aTJLSKZJLK7H9NLazPUwYR1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806913, "uuid": "d9b062c6-10c3-4040-866a-2bfe9fc40561", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806913, "uuid": "ca3043b5-af46-4cee-8e3a-c0a8c0603790", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806913, "uuid": "7f64808c-427d-4774-86ee-4dd21c0463cc", "value": "Packing_List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f85a57-5688-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638790599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790599, "uuid": "99b7d28c-e0e8-4e3d-b619-5dd7f78953e2", "comment": "Malware payload (AgentTesla)", "value": "dea93e59303e790acff14a3129b413bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790599, "uuid": "3254a6a3-f107-432a-bba8-9f803a2cce72", "comment": "Malware payload (AgentTesla)", "value": "6c6b921fd5fbb45a9efb659a3a2aecbfa7e7b6d0b5fc314ecc7a1f769b7fb303", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790599, "uuid": "9c708d31-fe98-4100-b0f4-003ce55b11de", "comment": "Malware payload (AgentTesla)", "value": "97dfdc38517a2cba5297642a695f321accc911ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790599, "uuid": "1641c35f-2532-4f27-8251-fd96be24576b", "comment": "Malware payload (AgentTesla)", "value": "5378b88216e3d6396037f19c63b7661774d9f6cf4060c1f85f1b4a79c5953654b7892b18896a10816c0f9520ee39a0eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790599, "uuid": "25038c02-1e0e-495e-8c12-2c11283a3fc7", "value": "T11994235718C17A7AD25073390EBB8F64CFBD4B8197B9043B9B298F9BACB314141293D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790599, "uuid": "ab12189a-db81-43b7-8fb0-b5ddbd3709de", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790599, "uuid": "0eff651a-fa9b-4df1-9da4-988f147f7ea0", "value": "12288:n6ab7oSFwUobl/9PhT1uHOJfRBJ2CgFEn8vJe/:nRDFwUohZhxuHO8F9va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790599, "uuid": "20027e6d-fd4d-4bf9-9844-33e50d64e7c5", "value": 410936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790599, "uuid": "f07e63df-87dd-4724-a8e6-54269cf0e932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790599, "uuid": "b77b638a-ceff-45cb-97a6-f3af9c64c86c", "value": "Invoice#8977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805f51fc-56b0-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638807660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807660, "uuid": "e799ceff-3f5b-4870-b9c7-92445c039a06", "comment": "Malware payload (IcedID)", "value": "ac3bd21396ac9f0d0be66e5616cf9c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807660, "uuid": "4d6b5480-b831-4cfd-8ce6-5c169bceceaf", "comment": "Malware payload (IcedID)", "value": "6d1440c1a48087dd20e2c147d855066146c87a24395bde1ab280a7286d499d7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807660, "uuid": "1a638d78-e58a-46ae-aa5b-96240ce3ea5f", "comment": "Malware payload (IcedID)", "value": "9a8025f1ac647be4fc0b195f9ccb45f72d40a025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807660, "uuid": "cbbd18e1-0356-4905-b6e7-b58c22b7644c", "comment": "Malware payload (IcedID)", "value": "c45ac83a7a6b73db9d63a5c7f3ff7ec6a1601aaa741149d48248dcbf4843972d5445fd29c70a1b9f20c51a1912315f47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807660, "uuid": "95df8db8-3589-4171-ad2b-3e622ead5b13", "value": "T1AA1538AE44CBC59FFEA18838DDA46AE3C293976ECD6AC9F34D8594302C114D9487B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807660, "uuid": "8c1af48f-9761-4a36-807d-f05af00aceb0", "value": "f6bdd1c75556d961afd6fb8104c342ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807660, "uuid": "36da72cb-478d-48e1-a631-ff5102560d84", "value": "12288:HfdCRsouYgpzEvqM8dxJ6IO7ByLErvB67sg:HYRx8V6IONyLErvB6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638807660, "uuid": "c361798f-1dbb-48ec-a62a-ac2c9b02e791", "value": 889473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638807660, "uuid": "bfac7447-de0e-4eed-9e4f-746ef2b938d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807660, "uuid": "8d26ae15-4da5-4aca-a1bd-d6c8f0d22cd0", "value": "girlPowDoor.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38de913-568c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638792258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792258, "uuid": "c492a75f-4f13-4a49-a194-6bdadfdb8248", "comment": "Malware payload (Dridex)", "value": "6c6cdcc4fa8430d331e63f16a7a79fcf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792258, "uuid": "91e96de4-11ec-4551-a4d8-11f0bbbf942b", "comment": "Malware payload (Dridex)", "value": "6d22c025dfc9ae47f722194f0c139b393e538c9ed467557476be20f19d7e7089", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792258, "uuid": "f6b5731b-968f-4852-ab61-9c5b690d4a39", "comment": "Malware payload (Dridex)", "value": "0f2c001fd39adeea7b789afc00c0c36681481b67", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792258, "uuid": "dfcb682d-7bf2-43e7-b8a7-1f4daa85e32b", "comment": "Malware payload (Dridex)", "value": "f883a1f7ebed3b20be183eef082e906a0eea867ae497922792d764aa6c4edcd1a3e0a515fcaefb3d8ec362d613d23d01", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792258, "uuid": "c552e2b8-cd5c-416c-88cb-cbebbbdd4263", "value": "T101A4D0C9C9F1ED19CE5C17389B5482BF12D24AAAFB73C8D9142C38D0557E04B7A6E42B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792258, "uuid": "214d72cb-a8e7-4ad6-8596-7b6b9c892937", "value": "25b0bc93ee5d63fd4e903616b53abcaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792258, "uuid": "8fec98f4-2731-4142-ac4c-14116eea23ad", "value": "12288:V73oeCf5A4RBa/+9C1Cha/CXC5C7C5CVAVIpCBCK:V74lAVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638792258, "uuid": "13c1d769-1a47-4282-a5b5-c24212c9ee37", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638792258, "uuid": "d8db9c4d-b119-4c4b-905c-fdcc6e903525", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792258, "uuid": "b87693e2-5913-4e0a-868b-def4f1ee0c69", "value": "z3xtyf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e5c6bb-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638765145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765145, "uuid": "e09e069b-0bf9-4754-8a68-863d6f1cd599", "comment": "Malware payload (RedLineStealer)", "value": "31eabb669dbd8262f6366b89b7b390be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765145, "uuid": "ac617c92-076d-414a-b27d-6dcb827eae57", "comment": "Malware payload (RedLineStealer)", "value": "6d6db3d2350de0ba05603b3ed3238bb5022ca300882fd4e709a6f424e9902c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765145, "uuid": "9c4b3d6a-ee42-41de-8ec1-2fde2c2f62e6", "comment": "Malware payload (RedLineStealer)", "value": "938aeea46b76f375afd85a22a3edbafe6db7a8b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765145, "uuid": "8e107e95-a279-49ef-943c-15001afa2538", "comment": "Malware payload (RedLineStealer)", "value": "af2ddb115dc9af3504ac80e1d08958f5dea897d381736f0f08b3553b6c4555cb76a8a0ed5ff3cd845f38cdee7bba1295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765145, "uuid": "7fb00af2-2105-4218-b6d8-f0bec46f584d", "value": "T1BB753CA296DD68D981007CB6D4086E0978E25CBE7FA9D35214B67C2E37F1032CE3D65E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765145, "uuid": "23d014c3-de92-499a-a4df-e17fb05e74e5", "value": "0a9fbc5fa98859752eaf0bffafd922bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765145, "uuid": "b3cab9cb-6aef-46d2-b057-7d527bc2649d", "value": "49152:S9m6RwwhMrhn7WiDogqozcl5K1e5jo/KpNm:11e5jo/KpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765145, "uuid": "6b2f3446-232d-48a8-81a2-aa9b3d149468", "value": 1589808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765145, "uuid": "ab008ed1-4125-4f22-9e3f-eee01bd56515", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765145, "uuid": "c01e6f73-1910-45c3-84ea-68c85fb1548b", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.7781.19395.9078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4430a53-5694-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638795695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795695, "uuid": "eeb4bc63-903f-4e25-8515-a8bd7672d61e", "comment": "Malware payload (CryptBot)", "value": "22d033dc49dbd4375ebd17ee2ca625f4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795695, "uuid": "0dbb8157-79ba-4574-a465-0e0e9f117a04", "comment": "Malware payload (CryptBot)", "value": "6dc0c842b4b2d4c9ce67fcd32dd1e3f14144a08bee6aa52e7a59e48258618cd2", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795695, "uuid": "0e8402cf-2ef7-42b1-9fa8-af84cd2bbf24", "comment": "Malware payload (CryptBot)", "value": "8f001fe879d64389d15c7a81c49dcd7c0ad5cbca", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795695, "uuid": "111f49c1-97f0-445e-929c-62d82ddd8fa0", "comment": "Malware payload (CryptBot)", "value": "55449f336991a26c65e45ba4ccad785d5ff7a76cec35cc7055a0d9d927e4c02b66d8b5918ac1583fed25a830a5f0a6ee", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795695, "uuid": "ec532439-98f5-47d8-aa5a-0c36415c7744", "value": "T1EC84CF0176C0C033D49765718925CBB29EBAB8701BA669CFBBD85FB94F243D2972530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795695, "uuid": "486ea108-5145-48aa-bd9e-6b8504ec25aa", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795695, "uuid": "8c7fbce7-f11d-4f6d-944a-e24e815e04e9", "value": "6144:ZlHJicpAou1JOBsePbFCyzkkcxKehDC9nI+qcI3DLEsFlJaPU:ZR/pAJKvb4wc2FI+aDLEsT0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795695, "uuid": "d484af91-348e-41f5-8287-fec5f3514d96", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795695, "uuid": "7b780c8b-2293-49ec-9df4-f09a6a40ebfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795695, "uuid": "66c6f67e-487b-466f-be13-369cca953017", "value": "22d033dc49dbd4375ebd17ee2ca625f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed75e2e-569e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638799954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799954, "uuid": "0b1c044d-36a2-471f-9365-54e18f114ce9", "comment": "Malware payload (Dridex)", "value": "dc3680122e796c02e0700af8efbd8d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799954, "uuid": "d37793ee-9e52-4365-aee2-9324e911ca27", "comment": "Malware payload (Dridex)", "value": "6e2c1bfe691c3b9ae8d63f04fb1c129c7935c8a02ea04a45511f582d4155a2ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799954, "uuid": "7f7f784f-e5af-40b0-bcd6-c499a2dcbd68", "comment": "Malware payload (Dridex)", "value": "adc1e7c1ad682693eab2fe4d2b2ff1d3b186b418", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799954, "uuid": "9d6cecaa-fd7e-4cab-aacd-8ea07a933d3f", "comment": "Malware payload (Dridex)", "value": "d78e8ac26a4d8ed4f3b8d20802310eeffd806cf2df3f0bc8628f803431e24661a19af599e10f3d1a0b8eb774035cdcf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799954, "uuid": "0b62b9f9-7ad9-4d91-b3e2-e399dfc002ce", "value": "T125A49F7CFCEBB436C411C7F0987793990D352619E2FFE6E0362B9087A7566600A4589F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799954, "uuid": "e28c925e-aa90-42a9-b144-539e7aa534e2", "value": "5293be9dcc3fe4423188dd90c7dd2d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799954, "uuid": "51821041-5ec8-48b1-93c6-26f2abc72fd4", "value": "12288:AQG80io88EmEkECG2EGoyEW+DBY49h4oJIH7ly:5G80io88EmEkECG2EGoyEW++HKyly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638799954, "uuid": "7fd84476-bcd2-47c7-9ff4-1827939e457c", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638799954, "uuid": "7cb5a792-1dce-46a6-86b9-2d183781edd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799954, "uuid": "c7b0549f-38a2-4dd3-ae37-7c4f173703a0", "value": "dc3680122e796c02e0700af8efbd8d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cd3ccb-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638802511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802511, "uuid": "3b1437f3-125a-436a-b385-4b9cb0d5c2ce", "comment": "Malware payload (AgentTesla)", "value": "9816e232e483690253133a0af1c4025d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802511, "uuid": "698fee98-a748-4286-a265-6108da2646af", "comment": "Malware payload (AgentTesla)", "value": "6e7236b8c73931b8ff88f949fd8d772c03640f5e7ef9151b793ed12c9cb567f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802511, "uuid": "6a8c95fb-c0e0-432e-a98e-5630bf116d32", "comment": "Malware payload (AgentTesla)", "value": "b8475f04f226a9a05a6f05f7ae1079815d58b981", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802511, "uuid": "76e5a6ce-5b6a-425e-977d-6fbb26df9818", "comment": "Malware payload (AgentTesla)", "value": "1d5e0194e761d8898d7763ea832742a806fa2568e60121fe722952244751fec24ed1f73c88f531ddccf787158643ee0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802511, "uuid": "a31be4b9-8b74-47ae-8641-be2a19deef9d", "value": "T1D305E09AF2441667D8AA0FF8C9A39880137B2FE25560D7097C8E7EC93F337464622757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802511, "uuid": "c0f6e1f0-6362-4197-973a-e546e6d16aef", "value": "6144:d1ltrDn0OHyAr0wnbQMnaEly76/VRN80vHK4UQhTIz2Ng5/avT0O/zXKhO5ajJr8:RtD00PbQoa9aK4UyTfkaARjZqEap5HB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802511, "uuid": "b0233670-f91e-45fc-8226-20f61f3a8b21", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802511, "uuid": "dab08110-2f4c-496b-8cb1-a309be6864b6", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802511, "uuid": "5c59857a-2d73-41b1-b218-d2a4a395c6ba", "value": "PO-BL00046749.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c320e7ae-56ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638806054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806054, "uuid": "79ae9538-bfef-4644-b82d-d1efc2a4b3c8", "comment": "Malware payload (Loki)", "value": "f1517cbb9e18b96d406653d6a648ae87", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806054, "uuid": "e8ed77d1-bdb0-4879-af1d-a0b080ee274a", "comment": "Malware payload (Loki)", "value": "6f899ae59c184d9e9b9798e1304999fc2004c4e3c04f2d33c0fda1ef5f2fd939", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806054, "uuid": "5fcb6e4a-487f-4c4c-ab2f-7beba32ea537", "comment": "Malware payload (Loki)", "value": "98687bfdfd1981e91ed60c9f8b63810643657f4e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806054, "uuid": "9a98e0c8-876b-4882-b4a4-84981cdf8706", "comment": "Malware payload (Loki)", "value": "fb3574470f06ffb23cf01c0ad7cdc6ec47391a4d7e17de8b50f8698b53741bf00d66fe2f933495e1ef24e208e20e456f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806054, "uuid": "f9ad756a-e7f2-4ab1-919f-0f026fbcf89e", "value": "T1AF3412C07902959ED40597F303A19BDA9860CCEFDB22B9174ED0F61F6A7DB781B08897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806054, "uuid": "06d70617-7792-427d-a15e-6e5949a196a0", "value": "6144:gSsskWYmYl7qE2IsGxscPwjziR0P0PqRo:/Yme72IsGrPwQK0PqRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806054, "uuid": "1fb6d07c-1681-4734-9f2c-d3c13873ac43", "value": 234968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806054, "uuid": "5d037ca8-6354-4258-8d3c-c94812ea36c1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806054, "uuid": "00e2bf21-9707-44c9-86bd-5444d1f0d62b", "value": "Invoice-WCIN-2122-330173.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0144eb1b-5670-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779959, "uuid": "4e85cef4-9456-4ad2-8cd1-ad5fff94c9ab", "comment": "Malware payload (Mirai)", "value": "edd68fc11d3aba996d6fdad74ccd0237", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779959, "uuid": "bd68bfdc-1421-431b-9cf5-4d5319910ed3", "comment": "Malware payload (Mirai)", "value": "6fedf876f9f5029c66c394e4b3c29393fa5060b490eadaddb4ad13c129052656", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779959, "uuid": "f5f7fc96-9508-4706-841b-de10509de20a", "comment": "Malware payload (Mirai)", "value": "9363ac9870c7c0a2d07ffd0ef45bbeb49a448efe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779959, "uuid": "2ab5cc98-857e-4482-a45e-bcf07eee08a4", "comment": "Malware payload (Mirai)", "value": "9441b22407ba14ba1e5418430e55b75cda2cf6b77a2e8c01d727547e3410353f84703c0e99abfd1ded5d5aaa5fa91c15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779959, "uuid": "9213dda9-a42f-48f1-823a-6e7bad136a00", "value": "T142B30893F900DF76F40ADB7604D74B25B670FBA20A532666721739A7AE321C53827F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779959, "uuid": "d1041d0c-14ee-45a2-97a4-3cfd4fe7001d", "value": "3072:cH02icJu2hkfzyEQUoZNyHdNXNe3D+YhoDBDhK8pK:cHSOhkfzDQNyHX9e3D+YhoDBDhK8pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779959, "uuid": "714c084b-d41a-4e32-92d7-762cd29668f1", "value": 107950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779959, "uuid": "26185e4a-354a-4eaf-a07e-8d41bbef2e67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779959, "uuid": "68185337-48c9-4129-8a4d-c8804bd2d7bb", "value": "edd68fc11d3aba996d6fdad74ccd0237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f077ff51-566f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779931, "uuid": "c08c497a-c162-4f51-a8b8-4f764773c6c4", "comment": "Malware payload (Mirai)", "value": "a97e719c8b1ca839c5b977146afc23c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779931, "uuid": "dc72d159-99df-42c3-9709-21bd3a081604", "comment": "Malware payload (Mirai)", "value": "7005226ea0a7bf03e830af258814afb7d5ed0936d27b96665a649ec099856f6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779931, "uuid": "9efdb167-a6a4-42d0-954e-0486e6893e85", "comment": "Malware payload (Mirai)", "value": "f005874ac8887f1a7fbad50feaa9a0120d895e18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779931, "uuid": "586dd1d7-90df-4a1e-ac02-7df38b5bf24d", "comment": "Malware payload (Mirai)", "value": "ee4c6de9f8556becc942aad3a91c776599965a9669de77239ef1ad131ed3da1ff37717d4b0586b16f76601fc45169f34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779931, "uuid": "ea5c7e4e-b63e-4e9c-8628-3154706422c7", "value": "T1C5C31801E5508727C2D2277AB79E965D37335BA493CB33215A34AFB42FC2B8D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779931, "uuid": "b2ab1e24-7360-440b-b821-6491e1071dfa", "value": "3072:Y7AvlFrvoWXa4t+cryFUj9RiC858KUyXiWmlF/SYY5sXZcF:3rvoIadcQg9RiCVKHSWmlF/SYY5CZcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779931, "uuid": "4697bbe5-5251-4754-9d95-4f8454817a30", "value": 129170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779931, "uuid": "ceaf90d1-88ad-41a4-8483-04d5d025d30a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779931, "uuid": "073e3942-bcc4-49b9-b334-5339c57dfb6e", "value": "a97e719c8b1ca839c5b977146afc23c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3419559f-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638808821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808821, "uuid": "12044384-e1cf-47b8-976d-801831c6e05d", "comment": "Malware payload (Heodo)", "value": "d989507b8064de8730742583f9ab74b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808821, "uuid": "d74b985a-bbc6-4af7-a9cd-1673c3e08363", "comment": "Malware payload (Heodo)", "value": "7063c2760832f169ad0c9461be0b2e75ffe87e36ac2c9097a48d6d915d7525c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808821, "uuid": "99e1fdbf-6e14-4162-90a3-76ff31a3b2c1", "comment": "Malware payload (Heodo)", "value": "b264fb3f360095a9db8df0cb36332ab61e7cc070", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808821, "uuid": "fc708dbc-772d-40f9-a18b-3f19e8338cde", "comment": "Malware payload (Heodo)", "value": "68073ad1d601c93cb5a4c797a503d902634b125c88ac118a267489be802ba9cead94b3d90c3fa5189eb794a87cb9a266", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808821, "uuid": "a677b288-96bf-49ad-9064-b91762348701", "value": "T1C0F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808821, "uuid": "7361bb83-8470-4aa8-9dcc-7e7ac3e3191a", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808821, "uuid": "d203c10f-827f-4fd8-98a8-b45046298f34", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/B:JapiKiBEmj4GbOX399Md9J/0TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638808821, "uuid": "a9709811-63fa-445d-a9dc-eaf8702ca4f5", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638808821, "uuid": "6190da9b-20c9-49b8-b143-14f1add09c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808821, "uuid": "784d2b67-c8f8-4d65-88a9-b3c29d6e360f", "value": "d989507b8064de8730742583f9ab74b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0f11ca-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638809130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809130, "uuid": "f9ccfd25-ed57-4880-aeb7-11e85c67796c", "comment": "Malware payload (IcedID)", "value": "c2326f5c2286b6272f7acde3e2d2915b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809130, "uuid": "c630745e-0999-47f2-9143-f07b03ee7a40", "comment": "Malware payload (IcedID)", "value": "714616fe3515adc2c2b44781aed900a9e8e37cc4e7239be92f1ca668f40945bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809130, "uuid": "de715ea3-2b23-4027-9025-cc8dab4602d3", "comment": "Malware payload (IcedID)", "value": "0f283ca3c4041e3f915af729371405bec94c50b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809130, "uuid": "d6267096-d9d5-4090-b536-ad827e03110d", "comment": "Malware payload (IcedID)", "value": "7eba98ca3c0c8f0e0775445ab362119d3de344720d698bf5149598b56cffcb3a8d282d5c0756ae3f7b67e4a40f6cf426", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809130, "uuid": "0135865a-9603-4a52-a541-10695260160b", "value": "T19F35AD0A325942A8D077D07CC9934B62E6B1B4058330ABDB13F557AE2F277E25A7FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809130, "uuid": "80f20159-e063-4354-9497-a5faf6b210b2", "value": "41c5062490a03a46399e3adf1715b1aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809130, "uuid": "b0cba33f-e0fe-4fc1-8fc9-fbd7e5e25d1c", "value": "24576:izOPAC+uOkZAw8pOKJXpQhpwxYn6OK8g7YJQNeV:izqGcAw8pVOSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638809130, "uuid": "8f497054-27da-4e79-befe-af977b345ed0", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638809130, "uuid": "6cf1da85-259c-403a-ba10-76726897d806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809130, "uuid": "6a8187a5-f404-4dc0-9d04-d0dcd7e7c4c1", "value": "c2326f5c2286b6272f7acde3e2d2915b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d5d559-56a5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638802844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802844, "uuid": "abbcbbeb-b78d-4be7-b424-9aa834ca04c3", "comment": "Malware payload (Dridex)", "value": "9b2d836d1745d7abcc2b44f103568092", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802844, "uuid": "52effc0a-0e59-47f4-a722-7d08cc9b2860", "comment": "Malware payload (Dridex)", "value": "715e4025522a6691b439ee398e1a69f84cd1469bde5a58356ddf9f0a93834337", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802844, "uuid": "774db321-b9e3-478f-8345-461c171af1db", "comment": "Malware payload (Dridex)", "value": "7b8e4a61ddb2cbd2751049e5465159a81309a1b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802844, "uuid": "7c4bf764-3f65-4647-9959-a8269b1e4267", "comment": "Malware payload (Dridex)", "value": "8493863e1653bc109e055beb71e1870c49637a3af6590cf7e74cec77ea9419cbcf8304057fdc43065a833827a75806c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802844, "uuid": "c0ffa87e-bf24-4278-8914-e215e2d5533c", "value": "T126A4BF4FEEF690B5FA32F8B174528292E1CB9C752002B7D485616A58FCE4C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802844, "uuid": "28f01681-da82-4e0f-987a-effa437f98d8", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802844, "uuid": "8b3c09a6-901a-46ef-bcf5-2627ad3219f8", "value": "12288:nCfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWRm:nCfzehtApz4lzQvzU3H2Jz+BbAt3A1NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802844, "uuid": "5e295a70-0701-4693-84da-571a3321b56d", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802844, "uuid": "182547ff-ed3b-4167-8e66-0f5dc8a59d07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802844, "uuid": "3d505150-7101-4bd5-987a-afeae7713850", "value": "9b2d836d1745d7abcc2b44f103568092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6387e3b4-5697-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638796875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796875, "uuid": "921f0184-77aa-428b-a30f-15eb22b804a1", "comment": "Malware payload (RedLineStealer)", "value": "c0ddb60fdd50cefa7080c13a173e8320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796875, "uuid": "1a852c06-76bd-4693-a36d-8fe0ef2d1ebb", "comment": "Malware payload (RedLineStealer)", "value": "71cbc629b7297c4fc9475b3a164b86c8a65eed9bf21b3450a8d8ae77a4693970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796875, "uuid": "b8c5dd01-763c-4bb3-8e12-0bf28852f23a", "comment": "Malware payload (RedLineStealer)", "value": "c20b17b238db01f89d3c81480d98e7e5d39020c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796875, "uuid": "3b2e53db-a686-4aa0-8dea-436299aa3df2", "comment": "Malware payload (RedLineStealer)", "value": "743b763cdbb2a802d2581c869f9ab1341c417acb7f5d313d37eece474dfc68e63572db09f463a23fb05f1e791249987b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796875, "uuid": "a1566d3b-e384-4756-9c78-2e4f2e029839", "value": "T1C4549D2133D0C032C49729764525CBB58EBAB4706A666ACBFBD42FBD9F247C1973530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796875, "uuid": "e2843e34-d08b-48d5-8e67-12853ab82548", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796875, "uuid": "46e4ec84-d910-4e17-80a0-c2f2a4de815e", "value": "6144:ijQ1RXDM6p/3wppTtvt4OPBpmtTBcAPP:iMPXDr4f9t5YrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796875, "uuid": "5c13f7de-028f-4c16-8a70-548edf08a85a", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796875, "uuid": "eb64dfe6-2153-4efb-a09a-bdb8a837e5cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796875, "uuid": "fa12959b-ae2b-4148-a3af-ed7e5f634fe3", "value": "c0ddb60fdd50cefa7080c13a173e8320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42a785c-566b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778219, "uuid": "c9345488-b8fc-4410-b545-844d9051c8f3", "comment": "Malware payload (Mirai)", "value": "fb100f54cd303f8dc7e46d1e95840909", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778219, "uuid": "ea89ad8c-3117-4817-b9ac-d1f4f57c33f1", "comment": "Malware payload (Mirai)", "value": "72057059579a722dee9e049d98944e29495bbc3f524936e675bfbd73c2b42c33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778219, "uuid": "9bb7fef6-75e0-4f67-8d04-16d98f46b5f7", "comment": "Malware payload (Mirai)", "value": "002d455e4f0f49f1763dfac8646cacc1ee6c93b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778219, "uuid": "4a68beab-3ebc-431e-a800-db7a7810f765", "comment": "Malware payload (Mirai)", "value": "4c481455b96cf17b17391c7c7b31dbd47649b2e7314dcf7008a5358a9859d1a264db43abf575e1c6f4f001f103247c3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778219, "uuid": "70851823-f411-40f6-b03b-d40b815d9045", "value": "T12403F1E3DBADD468F74C51394DBD7C4EB441EA889C89C06B7FC4112F7869A3C5329A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778219, "uuid": "126d7946-6db1-49f9-b420-d5965a6cdf4c", "value": "768:cW1Q6eYq/ZPlFiE+ClEXTsJRFrWAhoQnbcuyD7UGQRjj/43jnLc:nQyq1zF+WmQnouy8GyHAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778219, "uuid": "c7948966-abc2-4d60-8753-85ceb7eb4c30", "value": 38628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778219, "uuid": "3fe977a4-2adf-47e5-a4b0-491b15b8e5af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778219, "uuid": "46d755c7-cdb8-416e-adb2-2ae776ee41a5", "value": "fb100f54cd303f8dc7e46d1e95840909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ed8a79-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638775456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775456, "uuid": "1704e29f-9e31-4d87-88c0-31cbf18ba854", "comment": "Malware payload (AgentTesla)", "value": "78fa206d4b763b6550625da3b09396b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775456, "uuid": "48a8bac9-6bb3-458d-b832-3683234064ae", "comment": "Malware payload (AgentTesla)", "value": "7240d77bc0ef80fc479db99963c87b8913b449eeec881880739460ba2c9465b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775456, "uuid": "779b667b-baa9-4810-9670-7b52181d05da", "comment": "Malware payload (AgentTesla)", "value": "2ca4e5fdf061b35cfa1c721850ec87ae4ce81d61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775456, "uuid": "c56b91b2-25f4-4db8-9a70-ae022c27e729", "comment": "Malware payload (AgentTesla)", "value": "74c966304945ac1a96bfddaeb8d984fe71b2396e02a1b90c9a6dd65154d325a45f3e342009ce22f5c8210d699d0d9e5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775456, "uuid": "1f9683b2-deee-4839-8acf-fbf3475299c7", "value": "T162C4922C7A45C6B2EE1E81314DF14A28BB7F1F036640A98663DB69CB976F42D7D04DC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775456, "uuid": "45b93994-2cbc-4de4-94f4-0f62cd535593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775456, "uuid": "9737484e-f6fe-447c-ba16-9d64ed5e4fb6", "value": "6144:xMSVgI9ZiutwTV/q2wyFQHKbwo8YVb5VFJNx6+Si7FU3kftirZH7:xMSVgI9htepw7cwzuxJNx6+Si79lirZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775456, "uuid": "d328a856-ff2a-48f0-a729-8204812aa686", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775456, "uuid": "9b1ebb63-1604-41f8-87cf-376e73a7366f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775456, "uuid": "de64f8d3-93c1-4708-9ff2-e2e1117d7b1b", "value": "RFQ TECOFI 40941-190081.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be676906-56e0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638828380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638828380, "uuid": "80dd7658-7a1a-499d-b1b9-213ef44c05c1", "comment": "Malware payload (Mirai)", "value": "4bf25cd3cfb91ba4f34283d3aca7e0fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638828380, "uuid": "88682e38-100f-4651-97cb-e7a337758cd6", "comment": "Malware payload (Mirai)", "value": "7272b48a8697ba791c9e4ae967ad36447a2d0b0e8a60060b2b2df8bf0323e9e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638828380, "uuid": "907895b4-058b-4994-b5d9-64d592a36f93", "comment": "Malware payload (Mirai)", "value": "d7416d1d3a65065e7b931b96dd1162610b307fab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638828380, "uuid": "2060e746-7b54-400e-89fb-fb377c732a2e", "comment": "Malware payload (Mirai)", "value": "8815070cb3eca18a4d68a6da95c8036138fde39b93953111e50ce24d92e56c8f2770d8e315c35ff1f51a13f79b278c75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638828380, "uuid": "ca9cce56-3913-416b-ae62-27dec6263803", "value": "T1B5734B36AE251D27C0D4627A21F78220F2F6531E22B4851E3DB10EADEF78A4471677B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638828380, "uuid": "7e86506a-4627-4c8a-af44-95e10fcef12a", "value": "768:DsnoEjo/rmgb4ydlasD3/QPgsQqLszZO+75/GMg2FiF1tjFRmI3:wnjjo/Cgb4ydAuPBO275E/tjFRmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638828380, "uuid": "a4ed3ba4-0e35-470f-a99a-726e842b5a1a", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638828380, "uuid": "a051d6c4-0c52-4b31-9afa-18fe57dd015b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638828380, "uuid": "ac2f5211-2f05-4d8e-8edd-cc0ed41eee7b", "value": "4bf25cd3cfb91ba4f34283d3aca7e0fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f07279-56ad-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638806507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806507, "uuid": "9ba690a1-0db6-404d-b622-1c8045bd06f8", "comment": "Malware payload (AsyncRAT)", "value": "afad6d0f3e969a48812bfafc64813160", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806507, "uuid": "167795de-e0e6-4ccc-82c6-7585bcb786aa", "comment": "Malware payload (AsyncRAT)", "value": "72a983958afde8689f7fb24aa1467fbac81e961da3025f5798209932ae5a118a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806507, "uuid": "03581324-8b01-4927-aaac-3e16f51efcb8", "comment": "Malware payload (AsyncRAT)", "value": "ba76c9ea91820ddbb3cbad3b20f991cb59471861", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806507, "uuid": "d8bc0f13-d158-455e-9b5e-60af993d3348", "comment": "Malware payload (AsyncRAT)", "value": "6d9d33af9ebc2ea6688dfaf14544a7d72360a71457b2ab65c0570f8b605ebe09b5320d8487dc0b83319f0b86f46abb66", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806507, "uuid": "8972b7ba-dc64-411e-89de-817f54809259", "value": "T1C4014154D09CA87F00C2BB6640DAE4429670C35B07A0B930A010D149CC7C0FC9BDB9C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806507, "uuid": "e6d97b4b-5bb6-4cf0-9abb-c736fa5bb66b", "value": "24:RuaoIV9P6Y72EUDg2R/5/cyyfLyMgh9Etb:Ru1IVXCEUDh/cvLyMoER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806507, "uuid": "4e6428c7-342b-499e-a3fb-441f943d8a1c", "value": 850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806507, "uuid": "b52bc90d-b747-4199-916c-0dce8e536a4e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806507, "uuid": "92b8d961-e8b8-4d0d-afc6-4c79791074c5", "value": "UJY 65 567 FT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c98e59-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760457, "uuid": "10ec232b-52aa-4b01-8a91-1784ac5631d7", "comment": "Malware payload (CoinMiner)", "value": "193088fb190b205c8bfb5e4de2b394aa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760457, "uuid": "636da12d-3de7-4bf6-a935-57560da51657", "comment": "Malware payload (CoinMiner)", "value": "72c116a468f2d4b5f810b3116f85d5858c1caa076c814210b46371b97ad650c9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760457, "uuid": "54dcba77-152f-4d8c-92db-2c3cf06a671f", "comment": "Malware payload (CoinMiner)", "value": "f9ef80aadcefc44ff650b49f35f5bc11aec30266", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760457, "uuid": "ea4e78c8-be6a-4073-b8f5-1278b10d2e3b", "comment": "Malware payload (CoinMiner)", "value": "23ef868b5f8b529146c642cc7e586c71f9750d006b6998a704fd421d751f78abf56c1cef9c1eafd7de6b1ff953e3ad91", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760457, "uuid": "9fbc95d9-13ac-4df7-919d-7f3cd38c76bb", "value": "T11B9533407E60058CDA5CC73AB6F214F95A1BDD17AD1C67FB5C890A03B872BE2C5E84E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760457, "uuid": "64c01104-ac49-4715-ba45-2d066955e635", "value": "49152:CTFuFz/daFOJrZ1ocef3k0Rjfm9vF9xsuc2w/q1REYZNR:KFu9/dDJrZ1oceX2Psuc2w/qJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760457, "uuid": "3d37e1ee-49ac-4526-852c-d1544191f15e", "value": 1995776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760457, "uuid": "72849756-675e-4f26-b4d0-f67c2fae0ed9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760457, "uuid": "7817f3d3-6c7f-4b38-b32a-79bb0ad0c037", "value": "SecuriteInfo.com.Trojan.InjectNET.14.5949.16323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e04eab-56b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638809544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809544, "uuid": "0ff6a1f0-95f4-4bc9-83ce-1dc19b764db1", "comment": "Malware payload (AgentTesla)", "value": "c554dbf2754d01c5a4ec3f07d7c16725", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809544, "uuid": "ade9e114-6ff9-4890-85ad-94716a1f45c7", "comment": "Malware payload (AgentTesla)", "value": "74b01edeb72a379cbbc763554a7684ed11836f243211570f7ecdb316783363d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809544, "uuid": "8809b389-285c-40a3-8f48-53174333b865", "comment": "Malware payload (AgentTesla)", "value": "6a5af1485507afb3c0f5d3d43cfdcc017fda2815", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809544, "uuid": "40641f5b-f7a0-41ee-a992-887690a2c13b", "comment": "Malware payload (AgentTesla)", "value": "abe276e9f32e3fe89e6f4cdf9aa48b6b15bccdaf13dd56eb2e6fea140e880f8794bf5e4f642c760f1e4bec55ca6b7e7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809544, "uuid": "d2261b7b-f051-4a47-9a0c-f8445f512ffd", "value": "T159A4D04536D9E6D8FC3BEBB50CB075C503B8F2E5E681F2DEED88249998A27904F40572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809544, "uuid": "78c6f6ed-1d5e-4729-8c45-0541ec17d73a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809544, "uuid": "7e74c94d-3d50-4caf-8d01-e615f1f0fba7", "value": "12288:fbNsa2iNbbWFz6uAeE280ssssbGUSD/MdSZX:fxsa1BbWAuAQ3sznDUIZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638809544, "uuid": "5e3ff1b2-8f77-4456-ad4d-7a2110014e99", "value": 453632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638809544, "uuid": "ccbb8f45-626f-449f-8975-20129fe2a512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809544, "uuid": "1c78bc8f-c7e6-421a-88a1-c186bc9f617e", "value": "TT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fe72e2-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638802454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802454, "uuid": "4b972439-7670-41a8-8b01-8ea8212adf09", "comment": "Malware payload (Formbook)", "value": "2e4db102e3cfbeb12cb4da06b0af3c8a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802454, "uuid": "9f3b2572-572c-4c1f-b55c-3d187a241b70", "comment": "Malware payload (Formbook)", "value": "753b17e809bba08bccf782c835a43109b3bce47cc9fb5b5e3e24e746e77324e7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802454, "uuid": "c5dbc49a-91aa-41c6-91fc-1d21a1f5ffc5", "comment": "Malware payload (Formbook)", "value": "49bea682f0e52e4fff51484ec09355da73217178", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802454, "uuid": "7055e2ff-248c-4832-8195-7d58191ef098", "comment": "Malware payload (Formbook)", "value": "105d3eee0354239537419d43f922975db68b13d58ffd5848a9eb73850fd3273798940cad99f48073bd83ab5267e150b8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802454, "uuid": "ac21995e-0fc2-45fc-85d2-87f5dcd6355c", "value": "T1EDA42344B9389EC3B6D2007770DD22FA564E47CB3CF67A61D946EEE02F46DE1971102A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802454, "uuid": "8fe4e308-3177-4ab2-ba47-44bfb8654b71", "value": "12288:GYrIuamYBYslXNLMWxCmyhzrUuu55sgkjdnrGcR+:7IuAeYLMbRhP+OpjJGcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802454, "uuid": "67209367-998f-4e72-8cc7-784540bf9fd3", "value": 481074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802454, "uuid": "1695c6f3-1339-4446-a671-5194f90d1f2f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802454, "uuid": "8d5d8585-3a49-4466-a274-8453ddb316bf", "value": "EGX20210830.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d39b4ac-567c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638785348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785348, "uuid": "26260686-21a4-4193-aa94-6e61da669544", "comment": "Malware payload (Formbook)", "value": "7668ec6918487e0cd44618dc483139be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785348, "uuid": "96a54528-1faa-4483-ae83-f820d26ce60c", "comment": "Malware payload (Formbook)", "value": "75d1fc0cd78dd5787fe6215ab49ff546ff7ffc2ab99e439ab8f7b1d3274fc2b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785348, "uuid": "c2a93cd3-112a-45b7-990c-f326c05b01f3", "comment": "Malware payload (Formbook)", "value": "ac2048d268d8a00990fde9f96f90159b5213b19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785348, "uuid": "9a37a12d-1238-418a-976d-eebec6ee2b47", "comment": "Malware payload (Formbook)", "value": "574a4103ed943250304667eadeba237cd3011f989ad732a9a91f7494931c0645cba13f98b5c899e8228b4ee65eddc68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785348, "uuid": "56442e84-f413-4baf-baeb-a5da728d8ade", "value": "T135641246D5C28837F64F4BB669FFB32EE37196E901A4015B6FD04E4EBE20806854F9D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785348, "uuid": "22b7dd1d-e6d3-4f75-a354-6bc3569efe12", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785348, "uuid": "046228dc-49d7-4d1b-a2af-f6994a6bfed2", "value": "6144:rGiTilNapyrHfmbTVlI4S/Ay0UbFbQewZXb0DxUO4iTSq+D7x1DJJ9m:3iapYfmbPI4irFbMlQxDTSq8LlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638785348, "uuid": "932e0ce7-bbf4-4aef-8b40-ae7493a5ebdc", "value": 320165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638785348, "uuid": "88be3014-8900-4ff2-8256-7796cb84bb7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785348, "uuid": "a7effd28-ab0f-4d60-a4d7-4e795af3c4de", "value": "Doc_669YJ327400HG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcb444f-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638782128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782128, "uuid": "ef19d510-68bc-46a8-ae86-af29231a147e", "comment": "Malware payload (Dridex)", "value": "6ea483c95887a7c4b6807ac9480139ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782128, "uuid": "073b0bfe-5bcc-4452-9d87-5ebe15c3ac3f", "comment": "Malware payload (Dridex)", "value": "76e84f95544f022babce522480d717df069ce42032783faf63490973fd9d5376", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782128, "uuid": "62525087-5423-4c16-9c04-afedf451a72a", "comment": "Malware payload (Dridex)", "value": "4c59442cf388dd55310ea6a25e8eb08e3e220c56", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782128, "uuid": "2a778685-e44d-4cd8-add6-b937ea15a007", "comment": "Malware payload (Dridex)", "value": "b880e7ba433539da6dac039e27e8cba74792c08e9e1c3272fd7ca0e2104bf2282db50337e23a32bb32260b400832327a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782128, "uuid": "c8a63424-81ac-465f-81e2-995bcfaf8ed8", "value": "T19ED312A69BB1D832CF5B787E624E6F533643AE268BC37A03F291584C8100F1753D59E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782128, "uuid": "b5b086bb-bd1a-4333-8a1b-1fa885716d9f", "value": "3072:aDfoOZwq3BaVWg1M16TguaNTLGmtLfJ3hN8DqH9999999HqT99999999WnsAGanR:aDftwi+kLGmxfJ3hNci3OUdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782128, "uuid": "f17d3a2f-4979-4326-815b-97bc5099d5d5", "value": 135463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782128, "uuid": "814d034c-3617-4670-98bf-a75e3636a3fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782128, "uuid": "3222d61c-dfa5-4cd8-a57c-d4136c660de4", "value": "highlights-08942028836.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1100dc3-5658-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638769920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638769920, "uuid": "1387c755-a05d-439e-a6f3-fd24a98ffb6a", "comment": "Malware payload (Formbook)", "value": "45f9f827ed162971f7d8ac553974771e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638769920, "uuid": "4fa9972a-22e7-4efc-a51d-29d35e2dde4d", "comment": "Malware payload (Formbook)", "value": "77cedad50e25b2970cbc315d5d6afa68fb8c785da940126a1e40551e0d67c9f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638769920, "uuid": "6b994388-7d44-477e-b6e4-2f55b49fc104", "comment": "Malware payload (Formbook)", "value": "a6a43f88c88ad550a2b15ca47b1548190e6aad92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638769920, "uuid": "80d82f14-e690-470b-b297-93ef1fcda1e5", "comment": "Malware payload (Formbook)", "value": "20fb1096eea4cdd1e9ebf18d76a8423207c3f2538ef860bf60f77248bc0fa18328190afb4635c5cb70435f3012f10a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638769920, "uuid": "f0ba4e2c-3439-4a22-8851-139ac76a1c0b", "value": "T129B42552E5AA600FC3E5693CF032A19B4BD7ABF0AD2FC57A2F5DED1945B10470363292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638769920, "uuid": "99c6254e-5c64-4b5c-a9f2-cdff6f5c0aa4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638769920, "uuid": "48c12b2d-92c5-4b14-9048-be6c5cdef241", "value": "12288:NGPtUQuFe5FY/EpF/BZtmDzhng26KMhcE0/:N2UDFe5FY/Ep5BZwzhnrWl0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638769920, "uuid": "19146935-9bed-407b-a9ff-5572300cb87c", "value": 497521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638769920, "uuid": "3ed952ab-401d-40fc-81b2-5467b1003a91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638769920, "uuid": "313ee6de-cec6-4041-a2a2-f1f889084b32", "value": "Urgent Price request_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b119b7-56e3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638829406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829406, "uuid": "3d1adca7-bae9-435f-98ff-ff59061d6f9e", "comment": "Malware payload", "value": "bce50d5b17bb88f22f0000511026520d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829406, "uuid": "03f7b723-16e2-4489-9cb0-79740191fdf0", "comment": "Malware payload", "value": "77e40ca1c6001b2c01ef50b84585d68127eeb5691c899b049a9948fb60b13455", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829406, "uuid": "ca44ac5c-d0cf-4de9-a845-3f164a0d45f4", "comment": "Malware payload", "value": "599aaed4ee72ec0e0fc4cada844a1c210e332961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829406, "uuid": "c27b35c8-85c4-4e20-a01b-a9e10dbf2271", "comment": "Malware payload", "value": "bd100c2d863bec7e7c0f943ad8f8b483ec2f811789215fa7daa97c80d9ac7d771e8a85285d0da4ccb4f9b9eca7d9bd52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829406, "uuid": "306b538f-d005-4e6e-a825-c0f84d59d075", "value": "T1BFC4F10136C0C073D06634728125CAB54EBBB87556765A8B7BC91FBD2F347E2AB2532D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829406, "uuid": "15ebef4a-5a7e-4d50-bfc4-b3d8cfff027c", "value": "d661587f40953a8f9407bb1324edc945", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829406, "uuid": "0ef5d8bd-3d0a-44c7-ac4e-fe97f4af3cab", "value": "12288:2vOiWhzWms0/3QK9nVUCzqZq2xNd3aug3YlvKpS45:6shq0/19nVUCz6zVau4YEMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638829406, "uuid": "c92e12b9-ccdd-4b38-a7e3-e602b1fdc088", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638829406, "uuid": "ef1e0233-f73d-43ad-bfd0-8508f90db037", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829406, "uuid": "683b6da9-cf5d-432e-9378-4634ee316239", "value": "bce50d5b17bb88f22f0000511026520d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ace8bb-56bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1638812213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812213, "uuid": "303a177c-e8e8-4613-95d8-b167f4597771", "comment": "Malware payload (DanaBot)", "value": "d19ad5fbe2455393c8b4bf7203754461", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812213, "uuid": "c6655457-b9c5-4dd0-90d4-9582505cb644", "comment": "Malware payload (DanaBot)", "value": "7805fe3ed51586271c54f625091f394625e087a4157e3ad45e0222786772de8c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812213, "uuid": "72d0489b-16d3-4e16-aaef-6a62723a1b66", "comment": "Malware payload (DanaBot)", "value": "db97f0945094fb160c3f7154d230ed268842a6e8", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812213, "uuid": "9a65ec8c-e9bd-404e-aa52-01b62519f042", "comment": "Malware payload (DanaBot)", "value": "b48cfcda30af9c2b6deee26c121a463324aa51c969d452637f1b52ddb2a560a1ce4cfc853372cb9e72b1741ef5d06e8f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812213, "uuid": "95d2c5b1-3d89-4a3d-8292-7408b9dff2cd", "value": "T1514623A11AC471ECD88B5932996A1AECDC370DBD0028A9D71DDE728CA8B74C38F17D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812213, "uuid": "e1a8f777-85e3-41cf-94b5-584d79f35a27", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812213, "uuid": "69f79355-9508-469c-a4f3-d9941fb51046", "value": "98304:MZrPeaihwnzvobd1xup26U6qoXiRIwoNAjdY7l5k4HlLheY7l:MBPeai8Yxu9MHoNtjHlLheYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812213, "uuid": "9f5170a7-4dab-475f-b58e-84b338ae7352", "value": 5688568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812213, "uuid": "7851e198-e2d0-4d8d-a9c6-d027b29fd441", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812213, "uuid": "0e5f61b2-86eb-4d54-a12d-8cb5bdbd7a42", "value": "d19ad5fbe2455393c8b4bf7203754461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae9ccfc-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638765158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765158, "uuid": "8a366839-d0e5-4738-9ada-afd451e99a0e", "comment": "Malware payload (RedLineStealer)", "value": "7cb502c286f58dd0d74d136554acdd03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765158, "uuid": "8382b1cf-7e65-41aa-a95b-e8f0e55a2f12", "comment": "Malware payload (RedLineStealer)", "value": "78b66f88a582cf51f795d8299f97c92e7b9b932a22969b395a267cf9c741d1e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765158, "uuid": "14b485f8-1019-4636-8dc6-e3d35104bae3", "comment": "Malware payload (RedLineStealer)", "value": "17995b3febc9ae71887ac392c61dd692c7fa808d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765158, "uuid": "93709d28-1998-43a5-96c2-58d764f530ff", "comment": "Malware payload (RedLineStealer)", "value": "767e72dd87cb974d6acfd48527a3dccd7b5218700c9fd1d553b9ae062d375c76d8484d05140d3bae0bcb60f5ab646b5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765158, "uuid": "0cc45076-9302-4bc9-815f-d8e3a8fcb92d", "value": "T10984DFC1BAE18979D5813E3884218AE11B77BC51DAE0D106F634979E2FF33E4B672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765158, "uuid": "d74d36d3-98c4-4169-b0f3-97468d173916", "value": "f71176ab34b916e11877a7acc35c9980", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765158, "uuid": "2f600bdc-bdf8-4f98-ae6d-c8347d8919bb", "value": "6144:YvHEBrXV94HFKA8GXmlJIy+devb391hORb7ITsqXigaXwVfi:YvHEBr0lV8Go+wj39u97R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765158, "uuid": "75e0e5bb-0f7a-4071-905e-7cf87e38b96d", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765158, "uuid": "393efed3-18c3-48e9-ba2c-3698c9debe0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765158, "uuid": "b3083c0e-54c8-47f6-9ec5-47be033cc10c", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.26952.23277.2306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234d1252-56a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Alien)", "timestamp": 1638801921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801921, "uuid": "39305512-9fe6-4345-b66a-2b8d94693ec7", "comment": "Malware payload (Alien)", "value": "3ba482dd63f7e096e2a086385106115c", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienrat", "colour": "#DD2406", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801921, "uuid": "622fa642-7453-48e8-be6e-2c2477b1c934", "comment": "Malware payload (Alien)", "value": "78ea4eb0b59b244a0b52fa0de88c550792867f797f1b8b3d9325aa7f642218e9", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienrat", "colour": "#DD2406", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801921, "uuid": "51121f28-c233-4973-bc73-fb86dd7417a0", "comment": "Malware payload (Alien)", "value": "dea24869cf5d965d5681984f6b035e98dd083337", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienrat", "colour": "#DD2406", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801921, "uuid": "858702e1-e273-47ac-8282-70a7c6e8aece", "comment": "Malware payload (Alien)", "value": "fa40ff84b5a455a9869acd2096912e6861596e333cee47210106a838d9684bd418319e10cb0916f61debc90d4edfb96a", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienrat", "colour": "#DD2406", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801921, "uuid": "1cbe2a84-406e-4981-a290-3af108f6de40", "value": "T1919533A3930134B7E82EA6312027195F25AE40594338F9F4B46D79674B23FA27FBE534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801921, "uuid": "dc2f401c-23f0-4dc7-9400-733af6d4122b", "value": "49152:UsvHye4RIkE6mXnL6WU0ngAswFxbBgnGUjIHfEHZ3a:Xvt/6mXLaMgZwF3gGUjCOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638801921, "uuid": "8bdede91-c783-44b7-ac68-844fc29ad38e", "value": 1979661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638801921, "uuid": "87199794-b301-47d5-9146-52cff2d572bb", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801921, "uuid": "a781350d-59e8-4f70-8a8d-f61a54ed5dd7", "value": "bundle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b09c70-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638789706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789706, "uuid": "4ad3e8d8-82ee-41bd-9744-f97a2257519e", "comment": "Malware payload (AgentTesla)", "value": "eca5268a3b80389c78c9ae97c3b00751", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789706, "uuid": "cb96c6bd-d360-4ca8-9174-d832fd061ba7", "comment": "Malware payload (AgentTesla)", "value": "79a80a8b5a40a2fa83d968b67bf622a6cdeb4d247529cc034f9a992224354b71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789706, "uuid": "209707ca-e3fd-430e-8544-d6a82ada67b9", "comment": "Malware payload (AgentTesla)", "value": "c34993a9e5a24ef6cb60b164f1f6feea0de3ebbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789706, "uuid": "43acd964-3fd0-4319-ad69-5affc47cebba", "comment": "Malware payload (AgentTesla)", "value": "a39b9a106bba1e863d8c80ed3691ba7ca072ad092104187cdc5ae99fb100b80807833e1527c72d794186bc59332ce42d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789706, "uuid": "7d9ddadc-f5ae-489d-8583-2f9eff0e9ed2", "value": "T11482A5ADC49306A48F859BB8271B6F5A019CB26DF7C8A133313C67755BE2D7A4126C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789706, "uuid": "e6bffee8-6b60-4c39-8909-5dbd907c5db3", "value": "384:tplB603CchMH4F1CrHmDVU1u5FhWr+YgsQ:zC/ICrGeqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789706, "uuid": "23e216a5-bd3e-456a-ab28-21ee1465a1dd", "value": 18003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789706, "uuid": "820725d7-be8a-40c7-b97a-7ee5c4da3836", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789706, "uuid": "272591b2-8b82-4125-8498-fdab3e8598bd", "value": "SOA SIL TL382920.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95625bf3-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1638776342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776342, "uuid": "b313725b-cd49-4caa-8aeb-50b5d043ba88", "comment": "Malware payload (OskiStealer)", "value": "83437762e281a39dd2e3d24a77bed412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776342, "uuid": "1dfe792d-c21c-4643-ac5d-cc671078db94", "comment": "Malware payload (OskiStealer)", "value": "79f2322a266f7ae7af5686670d8e8bc93661506340aab5e9d63fd23517bbbdd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776342, "uuid": "445c203a-e29f-4495-9a4d-ab1a50f2f55c", "comment": "Malware payload (OskiStealer)", "value": "c818383759ac632ba7b418e3a830d0a9e90b7cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776342, "uuid": "6071518d-49bc-4188-85dd-5a8b7190a1f0", "comment": "Malware payload (OskiStealer)", "value": "391c87b1c89274656c7887670bcf0f03683353ea0cd3ac8e28f397d0a0d56c5652c8209c53f94a43f3406658544fb9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776342, "uuid": "58f4215e-6231-4bbf-8fba-09a19e44e056", "value": "T107556A1D22B508ABE87D1A74142107374EF26C3D95BBE7CD3788355F4BB26840A267EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776342, "uuid": "f12c942c-865c-4eee-a2b2-030e0b754583", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776342, "uuid": "762ab9e3-8dd4-4db0-900e-f8421f1ac8dc", "value": "24576:3mFS9SCwOOFXkrusLQ6J39QvDDIhx/GkjHKUbt25M5PfybZML6sb/hyDVeb:rSxtxs7JivDDsx/djHu58KbZML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776342, "uuid": "baeadb4c-bcf6-4dc2-8708-1dbde852d19d", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776342, "uuid": "1e0f5c88-1976-43e3-bfbe-61ced48a85ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776342, "uuid": "f822be7c-1a6b-4a6b-a7b0-6fdc6105daec", "value": "83437762e281a39dd2e3d24a77bed412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e618cc-56c3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638815917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815917, "uuid": "07cad378-a9cf-4c78-ac66-bd042e149dec", "comment": "Malware payload", "value": "e4567e8f597cdbee4d231f40d68da7bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815917, "uuid": "0e8eaed4-a1e5-431f-8125-476b4fdde221", "comment": "Malware payload", "value": "7a13ac8aca4950bed967f95387668afe758aaf20cdc231c4a29e96b93d5e2979", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815917, "uuid": "184dc8bb-f0b2-4daa-8547-6c0d5d9d72b0", "comment": "Malware payload", "value": "dc860fd4acbe157a09123616033e76ba03467139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815917, "uuid": "9d08a70d-b29a-4faa-8641-4761483b3b1a", "comment": "Malware payload", "value": "b38191f73f022dff1911ec282b3a08a02e2637dcf1d744ddea96a4889116c0e624af7cb13722bc8566890ecba7bebf60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815917, "uuid": "97e722c1-2d01-40cf-8cd3-92c8f11ade24", "value": "T150450211B2E28835F6F30A325DB5AA651E7EB9240932C96F23D44E1CEE70582D739377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815917, "uuid": "478608e9-af71-4fe9-9512-ffaeeab01dec", "value": "1de052b6f5f61e92a7bbc02c28a8de08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815917, "uuid": "320845e1-28cc-4256-8e77-6a1cf4c310f9", "value": "24576:aHNnN0QrlalXKTvpqW+gLb154O6pn3sFcVJCHekHqzaBRHPj8c:60QrlalKTxqW+qb15agcigOBRH7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638815917, "uuid": "a49f6b0b-c205-429b-8361-5e56bfa7cdfe", "value": 1255336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638815917, "uuid": "d22c12e4-5762-4732-a156-4f11be2afe38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815917, "uuid": "5ed9edf2-a441-4749-a199-64170c73f68b", "value": "BraveBrowserBetaSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897146f5-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1638802522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802522, "uuid": "1d8c2861-1d0a-4a80-a121-76e966c0a2d6", "comment": "Malware payload (AveMariaRAT)", "value": "4395af38a41e9747f81c86a1c154d475", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802522, "uuid": "e701f999-81e8-446c-bc95-11d13aae6117", "comment": "Malware payload (AveMariaRAT)", "value": "7a79b9d74c7f6b84a57d502f509172fd1c480e6e09e6fcad08ead1d66ddbdb41", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802522, "uuid": "49bf73cd-d080-49bd-bd07-762f2ddfcac1", "comment": "Malware payload (AveMariaRAT)", "value": "6e620838f6d5de6b4966aa3f0d51381298e08346", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802522, "uuid": "d26adf7e-f737-49ec-9eb2-4d4cebfe9be6", "comment": "Malware payload (AveMariaRAT)", "value": "4b0ad8ba4c63308cb7489d741f535630234215aac7dcb58261007864355ccc5283e56cabbd6203fef57b7b64c2c909f9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802522, "uuid": "4f836f93-fe14-4575-9c2f-5b0185b09718", "value": "T16645D054778D9DC2D4550A728CABE1542331E60A54A2CB2F78ED321F6A233933637ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802522, "uuid": "c090d79c-bf53-4874-a798-6e2e7bcad8d9", "value": "12288:lMrtD00GPhk/CX45x8QA8hnmPYxWY6JJ2M7cwaDHAmE0+xTS:YC0Gp4z5x8pKmPRY85cwaWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802522, "uuid": "f79a78c7-f9d7-4621-ac84-9381ec2ef14d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802522, "uuid": "f83c5c63-6d8d-48e7-b52c-dbfcc808c30f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802522, "uuid": "7d5fb04b-7013-4075-8a13-cb23eab62993", "value": "Remittance.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8026d57-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638775595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775595, "uuid": "735a8256-e1e3-4d93-8871-cf1ae5ffb9fd", "comment": "Malware payload (AsyncRAT)", "value": "c02e84489de1e0e5cc48a07c83ffbafd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775595, "uuid": "99fd980d-ea8f-4862-9bed-6de21f850286", "comment": "Malware payload (AsyncRAT)", "value": "7b6b38daac33765205fa376e53eda45dedf102d39365208a083bfd324c5a13c0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775595, "uuid": "da587aea-df19-499b-b928-2281d503864f", "comment": "Malware payload (AsyncRAT)", "value": "34823ec0bd1d0aeb33aa9060c1ef7dc2667611e4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775595, "uuid": "f0a4415d-e334-4a8a-8cff-e30c7763e17e", "comment": "Malware payload (AsyncRAT)", "value": "29ec6bf1ac14d2e48e592a1691234add37f5709bc0659c963c1fd2f7ca02b0b81f4ce595e210d76e83f94145d68ab72c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775595, "uuid": "8f698084-3c08-46ca-83bb-052fb4354f57", "value": "T1DCE47C7EE97E6E00E8A8473AC0E128B452B59CB2A311D87F9CD434DD4BF1A9C456D8C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775595, "uuid": "c0281ae9-9d71-4877-802a-f36af1dc7eea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775595, "uuid": "ac0ccd63-550c-4fde-a96c-3d42f90e8f5e", "value": "12288:PsGsQ+Z/MDnJeLBERLEU2y5n/lYlzC9+ht5C0Qt0:PpW+NUKdEa5/2C9en2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775595, "uuid": "e79448c2-cb68-4c3e-b019-4dbd3cf9dddb", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775595, "uuid": "4deda809-f9bd-4946-bbda-a19ddd0b943e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775595, "uuid": "615ddd2c-50ce-4fd1-9d36-8fd3e895d933", "value": "c02e84489de1e0e5cc48a07c83ffbafd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc972ef-566f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779952, "uuid": "c0fa5ddb-ce66-46bd-82e0-f06e4ef6d50f", "comment": "Malware payload (Mirai)", "value": "41572bdb7d2b12b51b2c60e02b597053", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779952, "uuid": "b0b41e03-c9cc-4f15-924e-a6ac52900d11", "comment": "Malware payload (Mirai)", "value": "7c1829cd134ffc87b2b719a240d6c69fee4175a2f2642cd7a2b0d674a096104d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779952, "uuid": "2b1090a3-926a-4b57-9c66-8a4bb3ef77c6", "comment": "Malware payload (Mirai)", "value": "064f5aa8fada562cc98166a87a1a609c8bf1f771", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779952, "uuid": "f4e09cb1-4268-4181-8fc6-f075e04fe9db", "comment": "Malware payload (Mirai)", "value": "dd8693c84f2a2a6f68d506bda661f0df2841720147ba3024adc11a0bbc85b4b20f472a37f0be73190d35873a55ba1ce5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779952, "uuid": "f221ce83-81a0-4fb1-a829-3f5cb8111764", "value": "T17C934C42B781C673E14316B2129BAF110533FABB1A1A9E56F36D3CF4DE150C47262FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779952, "uuid": "b7017fa2-02b6-4cc3-a3a1-76d21791741d", "value": "1536:n5DguOR7B1SnFdExs1z5KrHiGslLZzQSRsUQDW+NhIzAvM9Kz/Y:5DelBEnFdEW1z5uCtlNSpD9NhIzAE9KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779952, "uuid": "3188e614-e4cc-4527-9dea-88062dd9b7f7", "value": 90214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779952, "uuid": "3706ddc7-1a49-4b2c-b6ab-94f3596abc00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779952, "uuid": "35ddedba-476e-43a2-9f13-a2dffb3a1d81", "value": "41572bdb7d2b12b51b2c60e02b597053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0814a808-56b8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638810895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810895, "uuid": "1e370c2a-0aa1-437d-a0a6-b3d255c90d3f", "comment": "Malware payload", "value": "cb9584e168ee944fada92ca66fc72d02", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810895, "uuid": "c43c5d51-c40c-48cc-9c0e-44e6a20f6045", "comment": "Malware payload", "value": "7c2e1523261357d5db2a41daf6e01cc8e80004a736a291d30d082215dc5613d2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810895, "uuid": "52d791bd-9b13-4345-b211-cc72fdc8c00c", "comment": "Malware payload", "value": "34c2be0cb8104c055308675cf02fcbf59041f15f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810895, "uuid": "88813faf-ab6c-49f9-877e-48cd0e681208", "comment": "Malware payload", "value": "2fdb0de57b727b056032074b1b4e20c551a8da9b0d17c242bea2853309a7cd0f80d735afff3d32e161637ff4de9ea2c3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810895, "uuid": "9002a58e-fae2-4924-8d28-1209dca22ce5", "value": "T14A33C0BC16F9F9401105DA32DA40F87BAC492BBF9A7157F5AE92BA440425CD88BD1F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810895, "uuid": "4db1a9a7-475c-4479-900d-889567cfdf86", "value": "1536:73/AJ9YCYlUmGjVd9g/odmQ8S3AP3J5Bq/7THh:7P5jKmkiAEQ8eAP3J5Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638810895, "uuid": "afa3b9cf-a3a7-43c7-bf31-f0ae09819761", "value": 50469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638810895, "uuid": "f1c4d39f-42c1-4913-8a31-0c6dad352987", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810895, "uuid": "7fcd99f1-f1ac-408c-b592-4af1c94f0d79", "value": "Changes615846.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e863ea-5662-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638774015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774015, "uuid": "6c922313-7ebc-4223-b52d-82a01dcda427", "comment": "Malware payload (Formbook)", "value": "8d6940c3b3015f93039752d3d90cfbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774015, "uuid": "5077ff98-dd11-4f95-96d6-63d7e0c248be", "comment": "Malware payload (Formbook)", "value": "7c541e33f2b59431fcc38e07a221fa648745b21a90d651507bf32286f67281d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774015, "uuid": "568545c0-4236-42fb-9c49-57b86dd60102", "comment": "Malware payload (Formbook)", "value": "317f9e35b7d3d1230366262c2be614c027c91180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774015, "uuid": "4c81d06f-06ea-4a35-87f4-3cb7de0cc78d", "comment": "Malware payload (Formbook)", "value": "c2a9a98e892682fb695bd2e505db0dac3d8b0dfaa6d9fb818495784ef7643bbf8579c868d7a0c74d23e93ea009be61e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774015, "uuid": "75ab982d-4247-42b7-8a4a-db4c522951dc", "value": "T1BB557A1D26B5086BE97C1A305425073B5EF26C3D957BE3CD3B48356B4BB36840A263EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774015, "uuid": "c555c863-4981-4a8a-8ea3-96ce2bd34529", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774015, "uuid": "6dc3b198-f541-4b11-a516-856af1ff8937", "value": "24576:aHMIQnEZhLiqZwg0TXf9XMp971XSdmcQhBPZokKWkgpILL7:uXj0Tv9bmrhBho1Q8L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638774015, "uuid": "7451de33-5df1-4bcf-bb36-b2ccd69d80b3", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638774015, "uuid": "982f706d-6b0f-41c7-975c-3d03e670ea80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774015, "uuid": "a663df69-1c17-42e5-a010-e7c6cd41d795", "value": "n1qCzrnI4tr7EpE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafe4e0a-5696-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638796646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796646, "uuid": "f2caf0db-29c4-457b-90de-67d918a84634", "comment": "Malware payload (SnakeKeylogger)", "value": "a79b059ad6fa9f6db6085ab511afbd68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796646, "uuid": "24e259d7-d674-4632-b490-be8a0e89626d", "comment": "Malware payload (SnakeKeylogger)", "value": "7c9ec86bf7e62028b5a8967b2cb83020123d033ca981f6ce0193f2c5f7133b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796646, "uuid": "dd8ea0cd-d85e-4117-82bc-21902567beb8", "comment": "Malware payload (SnakeKeylogger)", "value": "ae8e5c2541ff2619a6f97b81c64c27cdb00f68cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796646, "uuid": "843fe76c-ab4b-4f50-b203-1fb81aa7e06f", "comment": "Malware payload (SnakeKeylogger)", "value": "283b7fd21cf6ba0de3623f2f1267215691e44a87b55893c4137ffa2659acef07abfd63915d00d3c98b00a5b33e9beafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796646, "uuid": "d0431d48-67c6-4f1e-bba2-fd16a8977bba", "value": "T125556B5C317025AFE83A853145540F7B9EF12C3E826B93CE7317346B9ABE5468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796646, "uuid": "94ea7e23-2d27-4395-b7d2-6c4ff6bf13b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796646, "uuid": "e1213cf3-1cb8-4d35-b268-dd00a258608e", "value": "24576:bJj1LhLdwZk3DfPkSGHCOD8sb9hO5jdEhBnggFUBtf7Kgis6Ij:1j1LRdwyb4HND5XO5dcB22DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796646, "uuid": "4f3f4d68-e2d3-4804-b5c9-72a221caaddc", "value": 1325056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796646, "uuid": "46752af0-4c72-4912-8333-38e5b01e32f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796646, "uuid": "7275d18e-b03d-4461-aa96-333ed2cb50a7", "value": "Halkbank_Ekstre_20211206_073714_893133.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa40f5c6-5688-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638790685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790685, "uuid": "8d310174-deee-4253-a027-e82d3bbbd660", "comment": "Malware payload", "value": "8d81a9ab988005a3980ded765a391123", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790685, "uuid": "06e3c7dd-e498-4646-af03-09f3b5e13a35", "comment": "Malware payload", "value": "7cf6138a3fd7413e81de38bf7457b4aa82ff01f948235837824df950f5dcda9c", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790685, "uuid": "fe4861ac-2310-483f-87f9-6e23a1e60c6e", "comment": "Malware payload", "value": "a3612c380c908bc74f5f1ab3e5981f7ec2d855bd", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790685, "uuid": "5352925e-e639-43a2-bdbf-9ad3672c7380", "comment": "Malware payload", "value": "777d28c3822d0250f262b87353b2d0fed48258d65f840b7dff0a4d0ebbe26c8f5a60ce18728df6bcc7713ef97ef5a29a", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790685, "uuid": "c1c41df8-9909-4525-b320-4c099d8cb0e6", "value": "T11072CF1CE8D45A48C77347F49646643A8A29F638644CA8DBF2CAA2282F9701B5FA175C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790685, "uuid": "9bad0e6d-1d3c-4992-85c5-3682ee5256d0", "value": "384:uSPa5XhQBGvlyR3w9KYXQZ6aVdgEByfOo08NCAQRegcx92s:TPi4IM3w9rS6aMTf0cCFUgcxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790685, "uuid": "4c0ff8ff-0f52-4835-8699-36e884665c32", "value": 16276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790685, "uuid": "aa175871-e2bc-4212-8648-a78009127892", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790685, "uuid": "cca536f8-27dc-42fb-8559-52af8468c6a3", "value": "Quotation Order.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01c345b-566b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778186, "uuid": "05bdcb55-9036-4322-b529-16fe18523fd1", "comment": "Malware payload (Mirai)", "value": "9e925d25a6e302ba10b14871f768ebec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778186, "uuid": "0a6e17bf-6791-456c-975d-92450fe604ad", "comment": "Malware payload (Mirai)", "value": "7d42f5790dede58c1a5a3dc2454cfb2912f5a04f78b598d1df7f90df38e0756c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778186, "uuid": "758c4650-01b0-4615-9dab-41dab5a514ad", "comment": "Malware payload (Mirai)", "value": "c08207e50cea2efd0a1c119f1759307ba33bd01b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778186, "uuid": "1a281012-ff99-4193-843e-74073c09e6d8", "comment": "Malware payload (Mirai)", "value": "7f80919bea902037d625cc36619b48b2504f80d90029c27af636e782bc8d8867bc29b5036b05ac03bc54d294ad9332cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778186, "uuid": "d95dd6a8-6303-4f01-a642-0dfb1122078d", "value": "T14223F1CDA06E4024C9F0403694DE80C22AE716FD65BFBAE2919DDF99D2E74C19716783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778186, "uuid": "96985c84-84e1-4670-8d6c-63acf42bee50", "value": "768:+JC23rdJuM/qcOa89nMRkPei2ARmfgy9RfKWGDis4H9q3UELLtHGv3rtsks:o3rTuM/qVnFMRbrxTV4tLLtHYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778186, "uuid": "4e2b1901-bda2-4d61-a81e-936127eca2fe", "value": 47644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778186, "uuid": "08e2b10c-7879-4e1b-8584-7687390aebcc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778186, "uuid": "8568b1ac-af68-415c-81fd-f801d39bfc3e", "value": "9e925d25a6e302ba10b14871f768ebec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a2c4ea-56bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638812494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812494, "uuid": "09e08176-ad89-447e-9f8e-acc4b393bad5", "comment": "Malware payload (Dridex)", "value": "2fcb09820ba15163469dddac3db7e433", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812494, "uuid": "5ec9df7c-5a36-4d17-abea-d7b43279f73e", "comment": "Malware payload (Dridex)", "value": "7dc116ccdf163ffcab2a978619c03943718d1ebe4a80df0d985b53c00d2aca2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812494, "uuid": "711932dc-15cc-4300-952b-e555bd4f2063", "comment": "Malware payload (Dridex)", "value": "e78a787604c3e36b0af2c3cd074f78f679c88fe0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812494, "uuid": "80efaae5-9ad0-4db5-aab1-ab8320af7366", "comment": "Malware payload (Dridex)", "value": "36083acc414f5b05d3bf2c44c34d1693b5c793be5254d2ab32ef741abb3198942fad17a42719331d341980160bc97828", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812494, "uuid": "101cc588-d096-4abb-bf51-3152b49dea0a", "value": "T14CB3122ED253B12AD23F497AD37F6CB80027B421C141A5937815F98C8B9215FE61EF56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812494, "uuid": "a390fce1-3ae4-4870-a4f8-54af7974f998", "value": "3072:q0kuuDnQOV1td/fKxSKREvpER3yPpIMoMG64zp29dA9:qln7LCQBI3TMoMuF29dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812494, "uuid": "3e3642f8-cb92-496c-a845-e54986b0fd3d", "value": 112227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812494, "uuid": "30e311c5-f29a-493f-a92a-0b9cdaf71659", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812494, "uuid": "8da322c5-24c4-40d4-a311-e1954b3d7cf1", "value": "Order_1637896172.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5d6377-569f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638800299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800299, "uuid": "b4cfabc2-f96b-4fcd-a138-5917e8eaeca2", "comment": "Malware payload (Dridex)", "value": "761bc462ddbcce63eade6b6e86929cff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800299, "uuid": "95df10be-0e01-4064-95a9-e6071c290d53", "comment": "Malware payload (Dridex)", "value": "7dd71dac4d68a8d49db4b0077f38225b597591ee52f96fd832acfa552d166979", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800299, "uuid": "e5134a36-a4f5-48c7-8bf6-797854cdca90", "comment": "Malware payload (Dridex)", "value": "c6335efafcaf572c3d3695369b580efcb2bceec9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800299, "uuid": "6f56ff87-270c-45cd-9bf3-aaa4ca3eebd7", "comment": "Malware payload (Dridex)", "value": "e3f73eac9db79e3796c66484f009c2f04de54db59251fbc2808141918f21dcf7252e7a553984537d5622954522d51e79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800299, "uuid": "a24fa4ba-6ad2-49f8-8752-b2c34b3826ce", "value": "T185A4AF469D16A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800299, "uuid": "79d36a43-b058-446d-a759-940d76d2232e", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800299, "uuid": "f39ce9b9-125c-4f3e-af01-74981dc0525c", "value": "12288:R7fimEsIsmY4K08oM1Wd8t5KQhNdv5zq:R7aVRBn7x6jtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800299, "uuid": "2e8ed303-73c0-4034-b796-6335c6fd0c98", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800299, "uuid": "b0507952-57e2-45a6-9efb-7933c4068939", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800299, "uuid": "610d0414-5b06-474a-b6cd-9d269080d571", "value": "761bc462ddbcce63eade6b6e86929cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc82316a-56a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638802285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802285, "uuid": "daca641a-5c1e-4be3-aa7b-206a81b4b66d", "comment": "Malware payload (Dridex)", "value": "597f642e707cd1b9382971c4f4e402a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802285, "uuid": "56da00c3-3365-4c2a-911c-f77d7db599ff", "comment": "Malware payload (Dridex)", "value": "7e4eb05983026790d6874df967ef5d1d00fcea1e2841a8f7d333b727d3d8dcf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802285, "uuid": "1ee81f19-57fc-4023-879f-0a13c36dc7d4", "comment": "Malware payload (Dridex)", "value": "a3f36fd94f3051306c15303b6eb26dad7b089a56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802285, "uuid": "efcb8f21-51c8-427b-a97f-4ee48933e9f7", "comment": "Malware payload (Dridex)", "value": "4e1c464f4d4e4179419736e5d79a0619dc4ff0dc7d676bd717de1faabd841c0b5c5b506af72cce01673934a2a895618f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802285, "uuid": "e903bcdc-80d9-44d9-997b-1acc4dcbc775", "value": "T167A4A0469D16A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802285, "uuid": "caf489a2-0029-49c7-9990-b1527705e5c3", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802285, "uuid": "aacf8a7f-b5d9-4dc4-a677-dd292f6d3d9c", "value": "12288:O7fimEsIsmY4K08oM1Wd8t5KQhNdv5zT:O7aVRBn7x6jth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802285, "uuid": "65d96fbb-861c-4af5-bba5-13d1397c9e2f", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802285, "uuid": "560d9ce4-6c78-48f5-880a-44600c7ab6a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802285, "uuid": "ebc45b3d-a09c-40f6-982f-912826b7e22c", "value": "597f642e707cd1b9382971c4f4e402a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f43498-5647-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638762660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762660, "uuid": "cc0f6e08-e91d-4409-a672-c3c30af029cf", "comment": "Malware payload (Vjw0rm)", "value": "dc3a4c8f39d6969e83d6bf43e207bd56", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762660, "uuid": "9fc3030c-9c62-4ba7-b9d4-429757c5c7c5", "comment": "Malware payload (Vjw0rm)", "value": "7f2fb0a3a6b84705ed3440f3a284b947c57d97ee21dafd6e0ce8e691dabc1628", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762660, "uuid": "6ef327dc-1cf3-4865-9032-739a08e79adc", "comment": "Malware payload (Vjw0rm)", "value": "3c5731d3ed4f8bb7ddc400c1f53d61ed6f191f4e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762660, "uuid": "cdecd9f3-9a1c-40e9-b1b5-89ee8cbb6164", "comment": "Malware payload (Vjw0rm)", "value": "231115f6908588ca79a5142bd1f01cbeb0b21d95ae935c771aef76a627ba5602a40f85cb867970400772900002c51586", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762660, "uuid": "2d627069-70e8-41ab-bec8-8e4112d8e386", "value": "T173838F019E431CC6F5B5C6A2609800E4DE17A2F4CF6AE4DADE4249CE0EEF24767C7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762660, "uuid": "8cedc7ad-3383-4238-a711-6943cc9a19c4", "value": "384:APnPI1gYzbBg55m/sguLC7X/g/W/W/w//a/t3J/QSNm6wUgl:vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638762660, "uuid": "fd26a7c4-31a5-4196-bdcc-3a47d5b1edc4", "value": 83682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638762660, "uuid": "08290ba8-7374-40a7-a9ce-25a9d3d13da9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762660, "uuid": "7c733bce-6022-4692-afd4-814d2091bcf7", "value": "87165304PaymentInvoiceReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fdfa24-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638773221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773221, "uuid": "4bfa623e-c846-4f21-bf6b-1317e3790bd5", "comment": "Malware payload", "value": "d01a3d30181731e2490a6d9e6c871507", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773221, "uuid": "e07d5199-750e-45b0-9afd-d33aeaa9ab5b", "comment": "Malware payload", "value": "7f3ac5868872edf16f5774fb63b03db2fefb96b5cd2503ae0006ea6ec36c7120", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773221, "uuid": "e9760b7d-1946-4fff-b42c-03bcada89a5a", "comment": "Malware payload", "value": "8d966774e60ceceda7e4c73ee0807c6d5a6990ae", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773221, "uuid": "637b04e3-3eb4-4d89-a388-769784b04b24", "comment": "Malware payload", "value": "74a94b66529e5dfddf6043527da111c29b4682e05a4c0ded9aeb92444c433c5602c5948cc55ca5c28c3fefa252c9ec56", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773221, "uuid": "e1de2122-86f4-4644-9650-66a84477642e", "value": "T1DC72C0BF705C9605D325EFB75B25DC7BBE10C0A78CE18B815A9C594C9B229C3B89970C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773221, "uuid": "a07ee2c6-beb3-4b1f-907a-aab548333cd1", "value": "384:9SP3mLJMUDe6t2guDDOeXlfsCYbqJ7KnXbt/xSRmxXw78oykKefAXcu:IP3m3DeimdVYbqJwmm5wAoy/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773221, "uuid": "f4be00ed-1401-485a-872a-7e10d34f8956", "value": 16498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773221, "uuid": "e1dc19b8-34d9-456a-9e0a-b2ec181d950c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773221, "uuid": "d27077d3-bb0a-45b8-809c-8cd868638030", "value": "PO-12062021.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0465e83a-5697-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638796715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796715, "uuid": "b93c1334-bb28-45e3-bb61-6cf4c712eb7e", "comment": "Malware payload (AgentTesla)", "value": "cdf7de2fa56cace3bf32f1efb0ef34ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796715, "uuid": "54646fb3-cceb-42dc-aedb-f210a74eac6f", "comment": "Malware payload (AgentTesla)", "value": "7fa6a4d85c62ac40108718d212e6a830a0239899bd3861af91a01ab058b08169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796715, "uuid": "66e83752-a69b-4dc3-8d32-f09e7c3fa0a4", "comment": "Malware payload (AgentTesla)", "value": "f92faa4c0ccec6cf1cd810be898d4fb21be23aed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796715, "uuid": "9141e58f-f9a0-4334-b115-aa53d3a7c433", "comment": "Malware payload (AgentTesla)", "value": "4a57f363fc5ac2f8eeb2d0ea847ec1d36a6df00dfdb2403d31643e1a497deb81b2a9645e903c4bceba113b3cf8bb10d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796715, "uuid": "e4aaefc7-fa3d-4888-8af1-8b7ea8835c3e", "value": "T19F555A5C317025AFE83A853149541F3B9EF11C7D826B53CE7317346F8ABA9868F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796715, "uuid": "be43c25c-910c-4432-851c-3b80a310ed83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796715, "uuid": "68f4a9d6-8524-4e62-8f06-16d7e389e211", "value": "24576:z+2PLyogm/JB2ooWkzxHKqEcdz+1QVXZq4ITLXMSAnZyrQ:z9PLN0HKqEcdiKdWr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796715, "uuid": "70185098-ad23-4ad9-a5b2-8cf462b39eba", "value": 1398272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796715, "uuid": "96dbdf77-0dd2-4cda-85e1-f3f9ee414cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796715, "uuid": "76b9e4a9-a728-4d77-aec2-4fd854fc0f30", "value": "Pago completo.____________________________________________________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1961d70a-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638789449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789449, "uuid": "1693376b-8d74-4a0c-b557-4e378cdc37fa", "comment": "Malware payload", "value": "ea4a1011d9b9d1e4bd6642450a64d2a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789449, "uuid": "0414b04d-c1b3-4db6-aa2b-f13a81a5f475", "comment": "Malware payload", "value": "806991a2798d80583e6667ff51b4a3898cc3a40f18a1d009c9029d28d309e54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789449, "uuid": "5326e448-4dbd-470b-87ab-9db461c38841", "comment": "Malware payload", "value": "a61a79208a9a6eaceae1027e4fe092a9ed4a63c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789449, "uuid": "a774ef3d-aa7d-4d0b-9642-d0f74173c4d9", "comment": "Malware payload", "value": "606b894fac31a3305c03f12a477b59dee7fab22b06a09cf4a7265c427f15c36404ec0ad1f2dd2c261950615af08b06b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789449, "uuid": "6b2c1b8a-6a9b-4aa6-8add-abfb7c3795bb", "value": "T11394023070C5F037CAF0193308A65766AE3CFA640D615B8797D6167E0F3F1928A569BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789449, "uuid": "39f4f93e-20f2-4ee0-a3fa-795f4ef90ce5", "value": "45d1f777fc6e9f6b5aadc41ed66055c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789449, "uuid": "beff8301-de5b-4434-a21d-5d82ebeee063", "value": "12288:ZID8888BpjZ9rZZNkCxhapClIYTw763IY2ep:eD8888XFxZfYYTwG3IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789449, "uuid": "0276ec2b-48d4-415f-8ba9-093fd6cddaf2", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789449, "uuid": "5efda1b4-939a-4f87-a8c9-893ca789c02b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789449, "uuid": "c3a3bed5-7442-4cdf-b894-99d5aeaabc4c", "value": "ea4a1011d9b9d1e4bd6642450a64d2a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b640633f-56cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638820206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820206, "uuid": "4c597deb-f5ef-403a-b95e-4eaf7d737304", "comment": "Malware payload (Mirai)", "value": "238997b32913acdfa1843a6809f58a1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820206, "uuid": "5fff4b5f-a4ce-4da0-bba9-1667ed2c52e3", "comment": "Malware payload (Mirai)", "value": "80ea727fb3fde3c01de58f793da53b98fa41d83a890c2360a5fba0516f55ba36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820206, "uuid": "64798779-0636-4954-b675-ed574cb9a7a1", "comment": "Malware payload (Mirai)", "value": "50f6d75714c84017b34d77ea1a6ff937ce585762", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820206, "uuid": "a757de68-8e8f-4ceb-a6ae-0bea4a8d6bde", "comment": "Malware payload (Mirai)", "value": "9109e2ca980251b718e04ddcd1aef08188a9efb85449cbe024f3efaa4ff000bc4967a26029224b5c74a203d4fd83aba3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820206, "uuid": "a81b5e38-b0d4-42df-9aaf-b18250ff8124", "value": "T11CD2D095C8FB06A9C5AC44772EDB2B8E5421C654881955E2EBF8B80BEDC1F10637C386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820206, "uuid": "334cd0f5-aa27-4494-a4f4-73212cb2a547", "value": "768:IJ55ogT+lbYMhd/FdGYfxQNoN/MOoYnbcuyD7UHQRjQ:A5oDlYMhd/FzfgfOoYnouy8Hyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638820206, "uuid": "200991d0-3269-4fc2-a558-b942fe95115e", "value": 29700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638820206, "uuid": "dc42c8a6-b8b0-4726-92e9-9592feadd08e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820206, "uuid": "633fc303-16ac-4323-809a-6c4786ba4aed", "value": "trynagetmybinsufucker98575.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16687f5-564f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638766189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638766189, "uuid": "d758f106-66c2-4ed5-b3a3-b6873a669690", "comment": "Malware payload (AgentTesla)", "value": "d74f268b986fecfa03b81029dd134811", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638766189, "uuid": "7cf3d455-52be-445b-9652-f56d258d8467", "comment": "Malware payload (AgentTesla)", "value": "81fcb3dce45b041a91b0c0e01c27e032d7e8d26217d4b6d669ce258b491a830d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638766189, "uuid": "3de13249-261c-4a4d-9ac4-0ff78c5ba07c", "comment": "Malware payload (AgentTesla)", "value": "d49848ac2888e080883a427ef18b406fdcab6b9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638766189, "uuid": "22769b68-a9c3-4926-b5d9-5a7a030b7b73", "comment": "Malware payload (AgentTesla)", "value": "fe305ae51be7ef0263171519b0c25b26b422f068268b44e9c63c461bdbfb0bf3bb8e36c88c69c6e7c1477df01484482a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638766189, "uuid": "29ab4bae-e50c-4f73-9f9f-809423413f99", "value": "T1D9F30229EF337928CFE9DB7F41E3198798A400913EC0D0FEA541E3BA56B64C162907D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638766189, "uuid": "0563b4fe-9601-4ffe-86e9-4b2ec04bd91f", "value": "3072:0kdLlXbO63/WbKfnRbUj1BLI1cf8wyYl4KBzK:JdLptDfnRyOdCl4Kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638766189, "uuid": "2f7a4b3b-fcbf-46ae-bc9f-ce04d8168b1a", "value": 166173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638766189, "uuid": "d3326e05-00d5-4dd1-a67e-afe79b973782", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638766189, "uuid": "f4b5ef3e-1d88-47a1-8c56-be129530cdce", "value": "invoice#6317236-booking.com,pdf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4404d4-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638765105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765105, "uuid": "e09bc613-25e4-4bd5-9f1d-bc24654acdd2", "comment": "Malware payload (Smoke Loader)", "value": "7279826ffa11db3df39e21cd53cf7e0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765105, "uuid": "f719e5c8-4ec4-4725-919e-d1590e4c975d", "comment": "Malware payload (Smoke Loader)", "value": "820fc220522ba757bcc3bbef4eeff4cb3561cdc751041d07fb81c120b86c6d6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765105, "uuid": "532db440-6562-488f-bbc5-7611182738ed", "comment": "Malware payload (Smoke Loader)", "value": "2fc50e99ab5ac4feaae82b22464a854f33948748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765105, "uuid": "aa865a7d-1311-4da9-a78d-449280526f0c", "comment": "Malware payload (Smoke Loader)", "value": "c8e3eb3da42fc4bfff4aa0a6f68b1ccd3790af9104cbb2d681f7b609a0e2d1b16500a49a998b527e5c7dbb3864603107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765105, "uuid": "cbc9443f-c8f0-44ea-96e4-5285f6322d1a", "value": "T17D549D1133D0C032D59729768924C7B58E7AB4706A666ACBFBC42FBD9F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765105, "uuid": "e5b02ded-96f0-43ac-bbfd-2eb3d8472f93", "value": "6c355763d97257cce28120024c0d5f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765105, "uuid": "b720d3fd-c965-459c-bea0-460a8ea24aeb", "value": "3072:SZ9JAasjGN1UIyKZgui9ZFoJiz+iKghFOhrDVQtLklefaxyLp+5pQHvj5fe6:cnADGTtdmZZ/hFADVUAlGaV+HZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765105, "uuid": "048057f1-5cca-4e06-8503-7b72b75b0db5", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765105, "uuid": "bf76cfc4-9b48-4621-8a5c-a9861c949d31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765105, "uuid": "2b1e09ae-79e2-456b-a7d7-9d855cb2c29c", "value": "SecuriteInfo.com.Trojan.DownLoader44.11112.23850.3600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be464d8-56a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803251, "uuid": "72b3b389-4c27-4d5e-ab6e-597cd08b82ea", "comment": "Malware payload (Dridex)", "value": "3091f7d3c38f9a9ce9503ce7fdec1aff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803251, "uuid": "27b429e1-92be-4bfe-b982-41dcb0af9337", "comment": "Malware payload (Dridex)", "value": "82345cc9ee20df05c381d7628d247dad74689cfddb9e2b14f56ee721323c0737", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803251, "uuid": "07c79177-a6ad-494e-98b6-fc9df3d407e2", "comment": "Malware payload (Dridex)", "value": "9c7beb2f3589d6b4a17459329215573b43b11984", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803251, "uuid": "ade63e59-9a41-4a1a-aa27-01e3c7c04c6e", "comment": "Malware payload (Dridex)", "value": "fb1980c0546133bcbb7d2b01a603f43448fe407274c876b6094674092e3036a9730d475dea853bdb0a4a75bfae5279c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803251, "uuid": "321d746d-a99c-4ac1-9c32-7453535b117f", "value": "T19EA4BF4FEEF690B5FA32F8B134528292E1CB9C752002B7D485616A58FCE4C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803251, "uuid": "9966b672-295b-4195-80e0-6a06b9f8416c", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803251, "uuid": "4136a162-fa43-4940-92f8-f58f14a915b2", "value": "12288:sCfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWRv:sCfzehtApz4lzQvzU3H2Jz+BbAt3A1NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803251, "uuid": "3b913b01-e155-4279-83ec-3479b6e28851", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803251, "uuid": "df16c462-2663-4bec-8867-e139169df3e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803251, "uuid": "a6d4e659-70ee-4c8b-8eb1-8c76e9b87dc6", "value": "3091f7d3c38f9a9ce9503ce7fdec1aff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664873f6-569f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638800315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800315, "uuid": "80ef9177-3589-4176-8c7b-b3f0745f45c4", "comment": "Malware payload (Dridex)", "value": "a6944ac62af797312a39f9fc1daf5b3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800315, "uuid": "8e59b6a7-05c2-4591-b007-839183d55a32", "comment": "Malware payload (Dridex)", "value": "82b59ec5899809d0e8bab3cbf8775d994af9cfb9213d1b3650032d263ebcba05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800315, "uuid": "0bdae7bb-ebb5-42dd-a6e1-56264e93d358", "comment": "Malware payload (Dridex)", "value": "81c7a007f1d6b8bb73ddaa933877d35f9976de4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800315, "uuid": "1274eead-4284-4fcf-82b2-9d7e5d9bad47", "comment": "Malware payload (Dridex)", "value": "92bec8bfb5c1dda9cf3798d0f36c95d50e598e054635da639a6e6d9b9f4c921b0b129c4acb0432fd283f9115415bd4be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800315, "uuid": "c0df76ed-c8c2-4534-97d8-2c44bdd45999", "value": "T18FA49F7CECEAB436C411C7F0987793990E352619E3FFE6E0362B9087A7566600A4589F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800315, "uuid": "38edc984-fa20-4768-88d5-56093a852d3e", "value": "5293be9dcc3fe4423188dd90c7dd2d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800315, "uuid": "c5f3d178-3626-471e-a3d6-7488ecc9824b", "value": "12288:tQG80io88EmEkECG2EGoyEW+DBY49h4oJIH7l8:KG80io88EmEkECG2EGoyEW++HKyl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800315, "uuid": "139868ef-804b-40b7-8539-bf76f3381b81", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800315, "uuid": "2f7f4779-83bb-497d-bf20-2d8dd9d77241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800315, "uuid": "a88faf24-373d-4259-afca-ab14ab4b7e62", "value": "a6944ac62af797312a39f9fc1daf5b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddeb8da-5696-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638796677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796677, "uuid": "ea15f720-07b2-4c2b-aee4-87da1c01f6c2", "comment": "Malware payload", "value": "97e08279789ab1582e2a8710d08804a9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796677, "uuid": "58faae5d-d255-4f1a-bf5a-41c98e855e25", "comment": "Malware payload", "value": "82c6b230c0ef47fab32f32050ed0e772b7e3cf33152d7cd4a2b2e87e42845165", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796677, "uuid": "09b70333-31fa-44c2-a078-9a81324bce7e", "comment": "Malware payload", "value": "48b5f8f0ed7ccf8cb982adf71a4f11656feab442", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796677, "uuid": "9d1492d0-8bad-4124-bb7d-8b201eb73f4b", "comment": "Malware payload", "value": "8413173fb01f767f3a086fcd5dc689907f45553685b816637f019ce3af2592f043839f3dfc5dbccdff67a1b4006134a4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796677, "uuid": "4139a688-1067-46be-855d-daa1fb0201e2", "value": "T131E32A9C6B4E59DCC70411A2B7A7B88502D9099D0BE3AE3ED163E04CF9FB825EDD4076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796677, "uuid": "d1d336b7-7162-48ff-ba44-a883279e1808", "value": "1536:KmXc2dfxbY9ia5C76JKHXJicRei+bGALKol3h+Kce4m7L8h6SwPGQ9QbSJ:hsAxs9icC76oXJicReP2oZVcQK6IROJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796677, "uuid": "c50c9911-0eeb-4615-bd20-68c1d799d2e3", "value": 143782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796677, "uuid": "e65bfe54-e155-40d0-97fe-26439781f594", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796677, "uuid": "6d60ee17-2aa9-4209-804d-66d1be7435b6", "value": "LOADING_SCHEDULE-PHOTOS_referenceNo-37376227000020ADORE-DECEMBER-JANUARY_SHIPMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1392ac79-5661-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638773548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773548, "uuid": "9e4deb27-5aac-40ca-a521-0ba101683800", "comment": "Malware payload (Formbook)", "value": "add22c25192679780368e3612948ffec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773548, "uuid": "df370216-c55a-4a71-b570-3423d984663b", "comment": "Malware payload (Formbook)", "value": "82e3f14333f9576780db5e61b3b550da857e7c3c14876c2abcdda031e5eede6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773548, "uuid": "40e5aed7-8cac-4024-ba64-aa28f81ee505", "comment": "Malware payload (Formbook)", "value": "a36c5f1992df5ba85558f345360e1d5509c95f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773548, "uuid": "83aea1a1-ab41-4433-addc-50c166031238", "comment": "Malware payload (Formbook)", "value": "b92ae10291d228ef70294e8e84095882cfa2749155fed76ea8fb122513bb98117f1fdf7f5118e7a4e39607f90d27e85f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773548, "uuid": "14be0ce6-bd54-41d3-b1e7-ceec0d584161", "value": "T19DC412DDBBC9B03AC19146F64C3B966DFB706824966682737300677F2F473E62E45282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773548, "uuid": "c14c0f01-1fc6-4703-ac9f-d08afbcbf5fd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773548, "uuid": "94a8471c-c824-424f-a13d-756b37b80e4d", "value": "12288:FtKL7eRbvnBjWKz9O2E9DuQVYhMMbzit2y1HKi:fK0BjW4+uQGhMWG24HKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773548, "uuid": "98ac546c-4924-4515-85cc-858e641a07f6", "value": 570509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773548, "uuid": "67e0de07-03c3-4f4c-b15c-092bf728fe12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773548, "uuid": "1b240bda-119e-4933-8ad7-3a39e8a49d14", "value": "Urgent Price request_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5b770c-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638760412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760412, "uuid": "c55c55db-5b49-4f9d-b777-df477203711d", "comment": "Malware payload", "value": "2db2f599b773f36a2ed6c8797e8882df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760412, "uuid": "d1ae9a4b-a566-4031-a1f1-fd06152dab87", "comment": "Malware payload", "value": "8303f7eae4b7cb8020a8c0c1a24ee427438fbbcb2803da6b0e3fd8aa43da6910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760412, "uuid": "54a7c1e6-67a7-4870-98c8-dc592f1231f6", "comment": "Malware payload", "value": "be5f83ef476e83ed5f2a2e77b8046ff86035e0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760412, "uuid": "8fcf8793-1462-4272-a6c1-ef01df39baad", "comment": "Malware payload", "value": "f8ecf1e2d81db246bc6c5633e36a5cc4e89c321025168db8bfe16d713bf914cf786f9847fa1ae5fd3ca7d6f4e72aeea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760412, "uuid": "74f14b4b-3793-4789-9140-23a6599652a6", "value": "T1FAC3126677ADA5B0F25F007DB0C60D0293DCBA27E3D7837517ADB2522D182A488FC96D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760412, "uuid": "0d355e38-7257-462a-94bb-d5bb674e5c49", "value": "e7decaf25f40094b75c326b377323c79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760412, "uuid": "7a55f645-122e-4bc6-a997-645c4c0e09b2", "value": "3072:+Qanxbu11+MLCQgPTOjVsWudIOPn4mbKdQTVX:6nxbu3+MuPO7ueOPnDmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760412, "uuid": "78ef4132-5999-4685-89f4-aab4d28f1d87", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760412, "uuid": "570b6d6b-307b-403c-9856-c8b702f69b73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760412, "uuid": "a60ec98e-a9c8-4e1e-b41d-039d7d58cf99", "value": "SecuriteInfo.com.Trojan.GenericKD.47566371.31888.25819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7a77da-5698-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638797398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797398, "uuid": "a13e540d-463a-4f62-8707-44e64423d222", "comment": "Malware payload (Formbook)", "value": "d1b98f6abc49cd0970be656456931e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797398, "uuid": "3493ed45-cfbf-4874-9a9d-cca0a6047834", "comment": "Malware payload (Formbook)", "value": "83776d9ef6bb1af94a265dd3778a4b7b3e2759397a944a91ba0889ca643aab5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797398, "uuid": "b6d777e9-e76f-4af0-a632-dc3f5afefdcb", "comment": "Malware payload (Formbook)", "value": "8a88e7ba2d538929087be3d5dfc82f06ed37ddd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797398, "uuid": "641fb770-2e55-475e-9b82-e02c97dc7cb4", "comment": "Malware payload (Formbook)", "value": "61193d7c6b163ddbddf88c3205ae33d261102c541415a5b396990b146bffc6cf736fbef842cd9010abeda2a62b8c0902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797398, "uuid": "40d3931d-afeb-4f73-8bc2-9e0f7d36aab7", "value": "T1B774230136D117EBC19082B68AB5BBA1E3BE9ACF5362ED4357D01FB66F1064B3145F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797398, "uuid": "bdb2a853-5f99-4eac-ae61-8167d8c38f7e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797398, "uuid": "6296d2bd-b39e-4c0a-b825-b51bd9a95242", "value": "6144:rGi5UkT9hVpWae+zzcIb/+CtNY2rbBwXFe/R9Snadv+aOjzaj:Nl9Je+cIb1rDR9m4v+aOjzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797398, "uuid": "a9b48b8d-2022-465d-b8cb-aee5e2cda8c7", "value": 361277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797398, "uuid": "8484fe3c-80fd-4fc1-a5ff-c14c11cb9a3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797398, "uuid": "cfc3e554-8435-41b2-a29a-fd7970e6704a", "value": "d1b98f6abc49cd0970be656456931e47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ecce77-56bd-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638813198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813198, "uuid": "698b55f6-38d3-4df3-b362-55fa1d60287d", "comment": "Malware payload", "value": "2f2a4630b9c7b32b5c50de768dad61c0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813198, "uuid": "93ef128c-129a-4ef8-aefc-cebfb3816ecc", "comment": "Malware payload", "value": "83a0a1e19c11d23fe929ccebf5de32757dd353d876b7cd05a628c228760dd7b5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813198, "uuid": "363503b5-d375-44db-8dbd-8172089a0b67", "comment": "Malware payload", "value": "df8856fbb867d3a6c458ae3ec6c9c946bd7c24c2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813198, "uuid": "f4406b67-1fae-4f07-b333-507fd2b63ccf", "comment": "Malware payload", "value": "a64216e72f8633e0249c0489fa2b21049263a8c918862804ecb6d92b7f2d1e8289c1326baf253a04e5fabc04c323efc2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813198, "uuid": "0097036e-51c2-478f-93ab-09df310f1c60", "value": "T1EA13ADB855FCFA201809E602CB10FA2AFC192B3BE6745BEA7C51B55A511CCE486D1BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813198, "uuid": "f0e1a9fe-9572-4106-81dc-c30173936787", "value": "768:K25wCtaWsA1IJE7ZkOz99NQdwFHKMOpUFd5VMHGNmc2N9eXyj5x:sSaU1Q2rJLGEdNmcXyjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638813198, "uuid": "8f7495c8-1505-49af-aa62-d6a5bddcf2d0", "value": 42806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638813198, "uuid": "014d4565-5184-464a-8612-46aba391be2f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813198, "uuid": "c59d8954-da87-425e-9099-ac8fd28186fe", "value": "Payment_956122721.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c384024d-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1638789734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789734, "uuid": "99e643bd-7d79-4185-8a40-e0fa692ea77d", "comment": "Malware payload (AveMariaRAT)", "value": "f1a79e61c508c4d20062fe29718be4c4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789734, "uuid": "77285133-1eb6-47ad-b3f6-ecef549be790", "comment": "Malware payload (AveMariaRAT)", "value": "83c2e04fca43eb8c38521ee7ac055fd87a58eaa1bfa7fd29e27dea4bd139a68a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789734, "uuid": "b6baf9cb-8164-429f-a619-01c17d6651b7", "comment": "Malware payload (AveMariaRAT)", "value": "ab5ae24a6a3a657162e8f1649b66d98b491c5605", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789734, "uuid": "a977390c-22df-46aa-ab9e-0de9f670ce31", "comment": "Malware payload (AveMariaRAT)", "value": "e8f4a6241ed8e193575f01654c4640dc42106674cd5ad87ee587d62d262bfffdd6dad1edd1bc30444c47dc6e48ec73b2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789734, "uuid": "b5bec2d1-9df4-4d0b-a899-96e03a8497bd", "value": "T16334120A35C456E6C8A749BB0DFE580EEF3ADC1448A24DD9F5F2B3158FB65368883643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789734, "uuid": "292770f7-7120-41cf-87c6-ac9ad4b8c026", "value": "3072:OneXRnHOl37EsmCk3vCQyFBzbgG/FbPFc+ZhjeDymMh5PUnEE+xVw8y:OEHyrzf+v/Kzb//FW0hjeD/AUnEXxup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789734, "uuid": "ff4ca22f-4c0a-44a0-811d-18c701003914", "value": 234616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789734, "uuid": "c75fd86b-35b6-49d4-8f21-aa2490dd9e14", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789734, "uuid": "84fd9e88-82ea-4f94-90e7-649d01456312", "value": "Proforma Invoice-NCCBH-099876-13321.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eed2cee-56c2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638815201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815201, "uuid": "ce23870a-2dd6-4ca7-8b5f-628ab3d72b17", "comment": "Malware payload (Dridex)", "value": "2bb5eb3666cdc2d83cf100ee45c1432c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815201, "uuid": "85efc53c-df68-4737-9005-b96da3754912", "comment": "Malware payload (Dridex)", "value": "83fb6738c4b1e467f585f29975f2c330206a3b8042edbe35424671e33c5fff87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815201, "uuid": "9bb54ed4-e253-4d1f-aef0-565bd6bdd3a9", "comment": "Malware payload (Dridex)", "value": "3b0190160f08e05b2688cf648dd90387a3e8ed76", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815201, "uuid": "522d444c-ded8-4ad4-bd84-1630e86042ce", "comment": "Malware payload (Dridex)", "value": "90c85946a6981776c76a8caf09e9df453b9f997edf698ddbba01395ba6bbb5dfc7b1d643888f68af63a66e55964eee90", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815201, "uuid": "39b2cb0f-d104-4505-a182-ba683bfb77e5", "value": "T189E31259E539346FC1F00D3A686D1AFA328266139DB190270AD57D2D9FA2F6F034E07E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815201, "uuid": "a61ad578-2476-4a58-b281-fb6555c6493f", "value": "3072:DSPCvQdOk4gBUYKdbm+QcI3W08+d2nYFn6ArhM+EdvV:DSPUeqYLm0JdcYFnju+Edt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638815201, "uuid": "e511aa07-b580-42c7-bd61-2a091ef63605", "value": 155500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638815201, "uuid": "4387093d-a4f4-439b-a8ce-a2eb7d18a1ea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815201, "uuid": "a005f010-8379-4254-bfbe-6fe8e4a3f808", "value": "insurance updates 258694.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272866c2-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638782170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782170, "uuid": "adc8c91a-1534-4007-b074-1e220e8c8fa3", "comment": "Malware payload (AgentTesla)", "value": "5cd7653773b7dff3130ec686f9721c43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782170, "uuid": "3e01023e-f004-4e72-9ee3-8f2e65242e6b", "comment": "Malware payload (AgentTesla)", "value": "8481aa55d679919cd517860d860f390f0f0bfcd4e3625fedddd81c8253de9b20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782170, "uuid": "43c605df-f046-429d-a015-290b05c90a39", "comment": "Malware payload (AgentTesla)", "value": "dcf3e73b22da1ab916eae8274a71be03e0b685b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782170, "uuid": "d62e72bd-8a13-44f1-9e64-34849691b852", "comment": "Malware payload (AgentTesla)", "value": "b12b757fdfc7ab38a6b644e9739e35d18ed7886fda37b100d3baf5188b115443b54ddfb3bb5c42153cbbd0ccb946a205", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782170, "uuid": "85c3c3e4-1de6-4b64-998c-6b8329ccea0c", "value": "T1E955BF58316035DFE827C03199581D369BB26C7A836B524F711B34AF8BBE946CF242F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782170, "uuid": "456f08a7-93a6-4349-abba-ec86673eda37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782170, "uuid": "78bc2f84-6f7d-4a80-88fb-9c99cc43f10b", "value": "24576:lF+BLeuqgAiTqz4QoOXHqCGHHEW8ZzXllPw7eQWFsdU9p29H35Y:kLeuqviTl6qCGHUlXrw7JWmdUq9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782170, "uuid": "e3f8a3d8-2fcb-4ce6-87b6-53a0af0d18d8", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782170, "uuid": "50d43570-7ee8-436e-9e65-1b55b61e0e88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782170, "uuid": "89ba2df8-d50c-4102-a078-7aa246526b09", "value": "TEFT9453567783888.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995a9318-56a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638800830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800830, "uuid": "4bb81d5c-d2dd-4070-8f2c-772ddc89f45f", "comment": "Malware payload (Formbook)", "value": "a7463b4d5c03e40d0f885dde0a6c8326", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800830, "uuid": "ecace24c-4882-4f38-80b4-3d315e58129f", "comment": "Malware payload (Formbook)", "value": "8494d6b3a4471f891fbddc9f9fa3fe5dfc3aef3c57f1837e56f7be324e7936f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800830, "uuid": "4e6c0217-0821-4b23-bd67-8e76e1ee8448", "comment": "Malware payload (Formbook)", "value": "a32377cb7bdc9e3284b89a15401f5a46a1c75ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800830, "uuid": "f1884662-c18c-4ff6-87ea-6648634323b2", "comment": "Malware payload (Formbook)", "value": "2ba35e8dfe9d44097dfa25b0a0ec28b2f75918b3809ec029470e9a526bd2a586b98734d9e282923f359e226abd34d2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800830, "uuid": "83d83e91-5f36-4fd4-988d-a0d5667beca6", "value": "T18F841213E4A5D4A7E94647B37A778B24E7A7FDB824B944070B787EF62BB305F8026140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800830, "uuid": "7367aa47-0e89-49f6-8367-bdd6cd70533f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800830, "uuid": "c3433f8a-32f1-43c4-b3c0-d5adcc4b5d67", "value": "6144:jGiNy3NnQkOzckEXGfINUdetxBq+WHyrxhGbZ8k3g5DVJ6rUM1yjGMcugZ1n6nPO:hEnQ7ckbdeXB/WH8xEbZ8vTcrUMwGMje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800830, "uuid": "98168095-e1c3-4316-b5b1-2e4f47b1065c", "value": 377289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800830, "uuid": "81f52016-a19c-4103-8b97-e6142957c808", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800830, "uuid": "d5bc751b-544d-43b9-b33b-8007d1a78132", "value": "Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ad4b40-566a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638777464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777464, "uuid": "2f621fd3-55e1-4534-ac2b-e681d76f54c8", "comment": "Malware payload (Mirai)", "value": "efb59789ad6492c43751d197318e5d2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777464, "uuid": "c9fdb8b9-e2d2-4dcb-a1ad-dd829c78728e", "comment": "Malware payload (Mirai)", "value": "8499c910ca9bba9c105b191e11b7fc2682e4b9baa69f2d52b3c51ca552764869", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777464, "uuid": "5ae5b7f2-ab90-4e68-8d4f-dae456c16708", "comment": "Malware payload (Mirai)", "value": "b79a769e62db1b2b79a417463f6482ebdb8986db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777464, "uuid": "a774e0dc-c9b6-494d-9fb5-cdeb946a3e4e", "comment": "Malware payload (Mirai)", "value": "1d654e90ebee71baf5743fbff9f453aaefaf2d176f85b6a9c71e9bb7d06cba0821a4066c36dec6893cfb555082b38d66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777464, "uuid": "a430da8d-5082-4048-b830-4fd5af7c432f", "value": "T12C03F2656BACED045B230433FB394D13FF2B2AB0D2B1A6251442D49B6EF7E871266335", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777464, "uuid": "3c28c982-8d80-49d3-8d0c-7471213452d8", "value": "768:9Zy6jo1jfTNRomhecxBy0KEXfP1a/cx3bs3UozRqP3UGbYZlPGt:L5jifZGmhS6XwBzE3UG+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638777464, "uuid": "81ebb548-e9c7-4194-bb3f-c4e44fb00398", "value": 39396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638777464, "uuid": "1dd58886-d89e-4e51-88d5-6666267d0b19", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777464, "uuid": "5995d7bf-9f1c-4547-8079-b84cf086c730", "value": "efb59789ad6492c43751d197318e5d2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cb6989-565d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1638772100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772100, "uuid": "9f71852d-8c61-486f-b3a8-7d410f5e88b0", "comment": "Malware payload (Socelars)", "value": "ff5bf2d1d1dac477d1e5cc33c6573719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772100, "uuid": "8f61bbe6-540d-4d6e-8564-d9382039ed85", "comment": "Malware payload (Socelars)", "value": "85fda4cc92f777c4468c5e7f3018452814d06176ecfa6c01bcfcbc19bacf245f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772100, "uuid": "cf0e29e6-c186-4a30-b0c9-702cd1357851", "comment": "Malware payload (Socelars)", "value": "5c84e58e7d167553409f6a5a64c05fac824bad57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772100, "uuid": "4dfb402f-2802-48fc-a604-f0d1be771cbc", "comment": "Malware payload (Socelars)", "value": "9319f215878ea6f8e2ebe2e84acfeb6e3baf6e5dec9b993272d9b629623e4aa1a5b84f87e3617453371f55e9f99cdfe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772100, "uuid": "1e6808a9-f8c4-45ae-b498-7d20586a64f2", "value": "T12665AE11F742A036ECE300B385FF56FE9D28B621030854D7E3C459696EA19E27B3766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772100, "uuid": "cd6c6ee3-5e0c-44b6-b880-06c9eab496fe", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772100, "uuid": "ebbe34aa-c59a-4848-a7ee-955498b918e5", "value": "24576:KEpfLmZkUtN/Wy+jtYkQkbF7vZjUodG/9QDE2hz0XCUZJAhwb0GXw:7pylrKY2D4+R50XCUZJC+Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772100, "uuid": "224782da-6364-4828-96ef-9e8107ee0012", "value": 1489408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772100, "uuid": "c3ffbc3e-b1cf-402e-bdb9-cc0511eae426", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772100, "uuid": "59484a70-0f69-4284-abd1-6770201e0324", "value": "ff5bf2d1d1dac477d1e5cc33c6573719.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d531f444-5671-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638780744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780744, "uuid": "1810b328-0297-4094-ba87-ddf6fb61cbf6", "comment": "Malware payload (Mirai)", "value": "8dd104672965274bcf5f6be25eec0d80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780744, "uuid": "82866240-b2c8-49f0-a90c-d9a119a7f2dd", "comment": "Malware payload (Mirai)", "value": "860d828864481e99c664263595f3c3458f019f6d95a3fe6d34151a301fef1134", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780744, "uuid": "44a502b4-505f-42c9-bdeb-7967cc559646", "comment": "Malware payload (Mirai)", "value": "9757be52cc801d3c8a5ed7dc3a5588ee80d18115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780744, "uuid": "4c664eed-b3da-4289-b3fd-c5ad0cd93d55", "comment": "Malware payload (Mirai)", "value": "ff669d4fd2f5051bad6b4674336b4e4839adbbdd4ed1a9faf2b58212bce29e830cfe96c1688c882129ebfa55861b59d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780744, "uuid": "09257665-8bd6-4b37-ba49-c9ad0501c945", "value": "T17EA32A13B71C0753C58B59F12CBB3BF08B69BAB112D76185A10AEFC05772EB12522FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780744, "uuid": "4a3315a0-0c5b-4242-be51-9112f0a15ad9", "value": "3072:3y83kMZY/gv6yHm2dNngDnJYhoDBg3K8ZK:3y833ZY/gWINngDnJYhoDBg3K8ZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638780744, "uuid": "7c57a9f6-b7e3-4a4a-8103-b81f64c93936", "value": 103226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638780744, "uuid": "6858370e-1269-43f9-a7ec-1790e837d12a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780744, "uuid": "cdd264d4-d87b-438f-b758-240247a70baf", "value": "8dd104672965274bcf5f6be25eec0d80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb296b5-5673-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638781616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781616, "uuid": "ab289c70-a54b-4e4e-b129-346a844c79fa", "comment": "Malware payload (Loki)", "value": "9686187fd7e4a6d9e3dba1f569c79832", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781616, "uuid": "c0cbd023-aaad-411e-8227-61878cdf11ea", "comment": "Malware payload (Loki)", "value": "86cabcae1b3d5779f400b12864dfb386e8ac6beb3982f8d4c5e79dcbd79b9306", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781616, "uuid": "79863460-3e18-4e90-8afc-3591420273c2", "comment": "Malware payload (Loki)", "value": "21a5d5828090e9c7e3c351a2703e893cb89790a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781616, "uuid": "7e01612e-51ff-480f-b4c7-8d605a55d276", "comment": "Malware payload (Loki)", "value": "7c791266b4072f67cb51539d87089bb06a40615b9ac537d40b3c49ec830a854d436a8078ae4294e943ab710e07e05a69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781616, "uuid": "821a14a3-2c1a-48a8-81c3-66ba0663f6ec", "value": "T13C942210B79CD63AC27DC63150A2094853BD7E843922C38F7AA9648EC9D3F9D6E1C9D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781616, "uuid": "47fb00ce-94d7-4538-a1d7-97fc30bc29ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781616, "uuid": "5ea5d2d8-fa67-4da9-b771-d2e39c442c16", "value": "6144:whVb5y4npYZp8rq5FhmUoKEPj3fYmbtuPxgtrh4KYkLgek2Q5x+sOU1nH+:kHpYcrq3cPUvqrhkk0nOgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638781616, "uuid": "0885c535-ff07-437c-aab2-6d5ba1b6a0a6", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638781616, "uuid": "4cc1192e-a23c-4a89-b94b-2af5571083ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781616, "uuid": "43acf5d4-27b9-4cd2-8827-648aa41c0ce4", "value": "9686187fd7e4a6d9e3dba1f569c79832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcec0bd-5643-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1638760838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760838, "uuid": "fd7400db-0622-42ee-958b-d3501e8f0cc4", "comment": "Malware payload (njrat)", "value": "a16047a43de04f8c9dd254cd39b37421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760838, "uuid": "45af2602-a291-40f5-a7e7-dba9baa8bf80", "comment": "Malware payload (njrat)", "value": "8859685e5de4d1fdab2dbbfa6899ccb8bbf1b8fb859abf129be79b19b0b87314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760838, "uuid": "ffa780e1-5e0e-4d70-b367-f0c1d06371b9", "comment": "Malware payload (njrat)", "value": "50cbe1b1a361fa7adc54c7c75a6d8b9248a889b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760838, "uuid": "41de349c-c141-4dd6-8169-b681ab2bb0ce", "comment": "Malware payload (njrat)", "value": "54424ab117f9d1838cc761e435a14af049ff7aa4ee45925161cdfc33502a074402cda4349d33b6a2a1547f30147cdd83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760838, "uuid": "6751165d-8c67-49ca-becd-0f2eeedff32f", "value": "T10CF3D52BB644CB15EF683875C0DBA43043D1ADCB0B33E64A3F49766D19423E75D4AACA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760838, "uuid": "8bf496b4-d596-4953-a5df-6fbce074f16c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760838, "uuid": "9d481c76-4780-460c-8c84-903dc6bc29ca", "value": "3072:oeG5CI4eiUKGneZLkqxtsSdReTGaLJ1GvAxP55:a9HneZLNb9/AGYGvKB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760838, "uuid": "d783285d-c90d-4066-8733-53839e74e690", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760838, "uuid": "0fd2eada-2b23-4264-ba9e-56a5dc943a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760838, "uuid": "f01468d2-0aa7-4ffc-bcc5-c570f3d659ca", "value": "a16047a43de04f8c9dd254cd39b37421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349d0958-568b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638791642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791642, "uuid": "4e851ff1-282c-469e-a59a-e7123e2fa88c", "comment": "Malware payload (Formbook)", "value": "5d10c77689e0c3bea850fa3c9ef40e8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791642, "uuid": "9489f886-e314-4857-a666-0729258e5652", "comment": "Malware payload (Formbook)", "value": "8a0fb297baf6f3affb73e0c20116dec0bbbae0292fcbffc3948051555df5099d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791642, "uuid": "242b8f70-b264-429d-8ea9-f24a08d16589", "comment": "Malware payload (Formbook)", "value": "35dca95d10a31fe0b1832f43005c0a79a6854604", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791642, "uuid": "45163207-10eb-496b-86ab-4369e5e8b78a", "comment": "Malware payload (Formbook)", "value": "5bb80d7b582b22cf7b5608d4e9824d069545c07c299f5cf543905eae2ad35e0ad9ce5d0c4d4355e93a904b0d3315359e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791642, "uuid": "bcabd99b-cf7f-4cf9-8aac-5481bd2e6a6b", "value": "T1DDB4018A6068542ACAD4713EAFB0DEF953B09DCD180556771FF47E9B3AFD09712023A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791642, "uuid": "360c1920-fb79-45b5-8696-bca0b51dc08d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791642, "uuid": "6ce6b39c-ec35-4ad7-bdec-affaa2630941", "value": "6144:wGiztEIOcZis3bJTEppPWz1xJ1AuSwDZOQIPYnXq8gYg+xhWXvgB1Zd4PU2u:ybsmFTsU1xJztZ3m6gmL441ZdoPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791642, "uuid": "de9c7228-a51a-4cef-a9a0-7d0c9939f875", "value": 528575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791642, "uuid": "32261a77-fb4b-4482-be2b-8c2e4544a88a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791642, "uuid": "a585481b-6585-4104-9392-3553a1c622e2", "value": "5d10c77689e0c3bea850fa3c9ef40e8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d23625-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638789740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789740, "uuid": "a90483fd-4a28-418a-9ec8-a84be76594d2", "comment": "Malware payload (Formbook)", "value": "75ff2ad7562cb84499dfa0885e11813d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789740, "uuid": "c912f086-6dc6-48e4-bdfe-7796c72bb522", "comment": "Malware payload (Formbook)", "value": "8a3e48550ae70dc076c4f0930dbb46afb3775dcc0f038943ba93483524465c5b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789740, "uuid": "d18e2a8d-23ba-44da-80a5-9f9da9b496a1", "comment": "Malware payload (Formbook)", "value": "85693dacf816a7f5d990da174c406e950b08baf1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789740, "uuid": "499d1e3b-06bf-47ef-af71-089e7902dafa", "comment": "Malware payload (Formbook)", "value": "d8484bf72cf5877a314b2cf4593f4d4a172bb285eb9f33ab678889324740fccb511bb966411bfdb6dcadc89f666000a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789740, "uuid": "c3d52315-e601-40a4-be71-d883820ad68d", "value": "T16F34125C7925DB60D0AD35BB4FB2FEAA2C70CF02380DE35AF2D13D942DB39A88695454", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789740, "uuid": "d8706135-387c-459d-a710-aebf7fb4912b", "value": "6144:wL9pY08E9i7kZQMpkp84zSo0sZ9DSSYACOpu:wLzokcp84e3CDOAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789740, "uuid": "3dd27357-a35f-40bf-ac09-e5ba6e20e96b", "value": 234344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789740, "uuid": "77702436-c35a-4499-82f6-65c2916c7b74", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789740, "uuid": "21245a10-d3e8-45bc-9ce3-3915d755eb5b", "value": "RFQ No. 109050.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913a1db7-56dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638827016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827016, "uuid": "81321efb-2cf6-4c95-a0f8-5b3895d675bb", "comment": "Malware payload (Mirai)", "value": "9a0947dcb16d14ec3b471bcb98028da3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827016, "uuid": "d043a983-61eb-451c-bc61-b2823770aabb", "comment": "Malware payload (Mirai)", "value": "8bbc8490b7e7e9e34901323e831828cbe3d9f3052ed58b8a4937d3e9bdf9a939", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827016, "uuid": "3b75b3d9-11d7-45b8-b202-8b5663a0f8f8", "comment": "Malware payload (Mirai)", "value": "b20a38fb5f5742b7206bec93c845fd08f9964491", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827016, "uuid": "3b8013fd-a700-418c-bccb-a1c7b1c3af0f", "comment": "Malware payload (Mirai)", "value": "97e4dfe9a65661bba198409d1c33b15645a571ae92c4cbb8316db1110fb293b96ca4575a8fe27922b98a0ea8f3395cd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827016, "uuid": "18eb710e-900d-4c08-8dfb-f185f74f0708", "value": "T1894302C1D623F270E9788D3775F83ACA2F2C963951DF3A931716075419D2A0B6A708BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827016, "uuid": "187959b2-649f-4f9d-9680-a106cbf0be7b", "value": "1536:EAIU63I4gO+zDEZ8jjk3tlbE7qL8tPTW+yq/W:ELR0zjnk3tlSqL8djVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638827016, "uuid": "277121c6-288a-4e0e-bebc-0b8aa99678da", "value": 58136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638827016, "uuid": "da7c2648-0946-422f-b4f6-471fcdd1a7a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827016, "uuid": "67132254-4d05-452e-8c6a-41b05a104ec2", "value": "9a0947dcb16d14ec3b471bcb98028da3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b4f5ed-5662-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638774189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774189, "uuid": "5fb2545e-d7b6-4119-bfbc-c80da3b7678d", "comment": "Malware payload (Loki)", "value": "0e005cfd7e4bcc7846064aa8528de9e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774189, "uuid": "4c958f0d-07f8-41c5-b27b-cc5347c0a5d2", "comment": "Malware payload (Loki)", "value": "8c6c641775d3ba8e0eae9b87da749bbf011ceaae1e4d80465e17e77ffcac7c2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774189, "uuid": "ea53e99d-21e9-4454-92f0-a920819dcf3d", "comment": "Malware payload (Loki)", "value": "734ab2e41d0d56f41c3d61435a766de2f0a9b943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774189, "uuid": "d4ba629d-e32e-4569-82c1-3ba426f6bc32", "comment": "Malware payload (Loki)", "value": "5cdd71f575efd2b827c7bf9dcaedb903ef7d7f02a0dcd37a9d3143b48251a41fc11c8dafa4a12279941fb997f90f38e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774189, "uuid": "1158c394-b6e7-4acd-ba40-da1426e38ec4", "value": "T19845691D21B5096BE97D1A34142147374EF26C3DA9B7E3CD3B48356B0BB36840A267EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774189, "uuid": "5bc0807c-12bb-42f5-b060-f7dc1a262b5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774189, "uuid": "89f0be2c-7016-479d-af63-3a9bc9e8d16c", "value": "24576:kh9XNPgN+BHNDuMGLmDfSeWBYGmHh/gpeuMAvNyE5zOz+oLl:kUktDuFUf5Hh8eupvNLsFLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638774189, "uuid": "70c34021-5671-47ea-bccc-27b49b0cb46e", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638774189, "uuid": "21855850-43a4-4df2-9220-158ea8011de7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774189, "uuid": "15597d15-6d30-4188-814d-ad27d82d03b6", "value": "0e005cfd7e4bcc7846064aa8528de9e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e95427-569d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638799531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799531, "uuid": "08a6ebcf-b077-47d7-8169-77d8ada00cd8", "comment": "Malware payload (AgentTesla)", "value": "284860044b5050b3c212b027ff38fffa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799531, "uuid": "a7382c71-17dc-4263-9ee8-648bf1a5004e", "comment": "Malware payload (AgentTesla)", "value": "8d381833fb91856d2001584e0ebb70bc76699a3c63d63cc254f1c5e38727da62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799531, "uuid": "5cc578a9-76ba-4d35-962b-924b9de6e37b", "comment": "Malware payload (AgentTesla)", "value": "b0ccd8da217f8aa6d97e395ca95f3903479f3bd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799531, "uuid": "70b8af11-d810-4392-89f3-bfe3711afcf7", "comment": "Malware payload (AgentTesla)", "value": "b3f6ed7e02527d1ae668aae6f48cf77211b297d0d800438a932ded6130ea40301e1f4d833cb63ade80a6e4256c225785", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799531, "uuid": "639764a6-a21c-4d06-be3f-bef6f08a6354", "value": "T1C2656A5C3170259FE83A853149541F779EF12C7E826B53CA730734AF8ABE9468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799531, "uuid": "df10681a-17d6-43b3-a29e-931449ccc274", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799531, "uuid": "e3c6300e-ddd0-405c-8c6d-56f82fa0aab1", "value": "24576:ncyLwUPI4Zw9Grh+gCjcavggzEu7YZxh5AeF9W5zwKD:ndLwr4ZwwF+ptR74x59W1JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638799531, "uuid": "055436a2-772d-4b8c-9c06-c4d93852b0ac", "value": 1430528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638799531, "uuid": "6658ebc2-4366-4cb9-a3b6-b66316c819d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799531, "uuid": "212becf1-583a-4694-aa28-2226fa7fd377", "value": "Pago completo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd170c2e-5661-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638773939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773939, "uuid": "2360ba34-bf5f-4e1b-ac2d-49cdec56f9c4", "comment": "Malware payload (Formbook)", "value": "3b8a2f45e45e37a9361dbd9653e4ddfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773939, "uuid": "3c382b47-cb91-4ee6-949e-d6a46a5bc4cf", "comment": "Malware payload (Formbook)", "value": "8dd180ffb15b5045ca6f56b5402cabfe2b70423811881190a71efca614cd23e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773939, "uuid": "dd990af7-33d7-43df-8911-be65683813cd", "comment": "Malware payload (Formbook)", "value": "281394a9385afbf84f14219288db45f86c582299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773939, "uuid": "f7d16954-8400-4fe0-827c-4c1468e6add7", "comment": "Malware payload (Formbook)", "value": "a02dd030bc5097983fdd6909eacb80cf305662d91711c080a7410f370cb4d693a0c2c476c225fedab06fe16c8f3804c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773939, "uuid": "5b721b78-2c5f-40a8-a0be-2807d74e8736", "value": "T1BF55691C22B5086BE97C1A34542147774EF26C3D95BBE3CD3B88356B4BB36844B263E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773939, "uuid": "7518ca9b-7748-4208-88da-11b83dc386df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773939, "uuid": "1c2e958f-1098-4051-abe8-6e052738f4e5", "value": "24576:3QYsM7S0PhpC1Te62SsZPkBd+2P9eiBu1YsGO1z4LeSzHtXv5+L8:DPiJxsZPli1sG8ULeSZh+L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773939, "uuid": "a1110029-4c25-4ad4-9369-4d41722512d4", "value": 1317376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773939, "uuid": "3a2cd098-117e-4136-a29c-c739a825c68d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773939, "uuid": "dc6a90a0-f6b2-4918-9693-19480d7885ae", "value": "Scan copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cfdd42-5698-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638797383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797383, "uuid": "304408d0-2c23-49f7-b794-e58d4d50f589", "comment": "Malware payload (Formbook)", "value": "f86c2fb3c00fe61bd8b09a8fdad039bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797383, "uuid": "43e5b1fe-9ae9-4b92-9ccd-b25854c99816", "comment": "Malware payload (Formbook)", "value": "8ddb1b007d499a165554e933dcfb0ce8a7ced3506f2609c2a5225c64755bb69a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797383, "uuid": "a88ed7ff-53c8-4ac7-a685-f4355eed7411", "comment": "Malware payload (Formbook)", "value": "e59f2ee3dbc71abe32975d0b0d9546354232ec49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797383, "uuid": "b01ab33a-6470-4af6-b630-ff8a774eb7c1", "comment": "Malware payload (Formbook)", "value": "70b4e558c8e525ef97998eeed3ac09177ed71a7808ac8e930b840d57014c844df8c19b7d243ca0f09eb52d580f1937b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797383, "uuid": "331960cb-8509-4ec2-830f-503e6cd7a7f5", "value": "T1B1B41639FDFF6A85C210DE3A266DB15A52E19C58CE9B433BE1D472A57E30CC80A4251F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797383, "uuid": "bb09efcf-0318-44df-b2b2-95bce87678e2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797383, "uuid": "5d084676-0d9f-48ac-b651-83ad1215240c", "value": "6144:2GinGISkO8EAknfyuLwaWLgS/WRJql8uXSRrP0Zcf769x5DeF63W9CUELQ:/ILO8EAy6usHgS+RxRrP1efpeMt9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797383, "uuid": "fee415b8-cb34-4620-a4df-4b1394d6b1bb", "value": 530343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797383, "uuid": "a8896f0b-4f41-41c3-8064-e40561b61dc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797383, "uuid": "6ff00d5b-4fda-4e08-ad53-3557921fbbe7", "value": "f86c2fb3c00fe61bd8b09a8fdad039bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe15d8cf-56ae-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638807012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807012, "uuid": "459c1322-56f5-40fe-94a9-e3b42845bc68", "comment": "Malware payload (Mirai)", "value": "594597e0ede6dba5d3101f643f72358a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807012, "uuid": "f3212bd0-56a6-413a-8490-af77ec9ea8d1", "comment": "Malware payload (Mirai)", "value": "8e1227b67a61c11f0aaa15551847d5d298df4b2c6900702f56b1693e4babd79c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807012, "uuid": "ecb4ff2f-0b65-46f8-9279-7884639d2df4", "comment": "Malware payload (Mirai)", "value": "04524d215b0022cd8cb2276246d34776c6bb6b9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807012, "uuid": "895b797e-0781-45a8-9c64-48af641ddddd", "comment": "Malware payload (Mirai)", "value": "26044e9e6776931bd352b67aeb5356b7b97346e74f25bf45ca8b0e5e3a6a64d1808cb43831f649e5354b90b3af8acf45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807012, "uuid": "be8f8d72-7715-4241-9d1c-8bf6744858f8", "value": "T12443F80AFD41AF01D4D922BAFF0E114933936B9CE3FEB1129D112F15A7CA95B0F6A452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807012, "uuid": "ae73e4fd-5c74-402d-8eb6-bc98610aa082", "value": "1536:04nIpb/pEXVTB4UjsumNujEemfdlAIidND0n/zLwbZn1E:wx/Kn43umNujEUDND0/PwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638807012, "uuid": "2e9bd31f-1f59-4e95-b939-fe793086dfc9", "value": 55892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638807012, "uuid": "8a3169cc-aa68-479f-a8cd-77142253dbb0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807012, "uuid": "b524d32a-f320-4fea-a682-d594a11b8ddd", "value": "la.bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04bd130-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638809029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809029, "uuid": "950f9f5f-335f-48cc-9901-a1f56b0e505a", "comment": "Malware payload (IcedID)", "value": "9fcc6c4893cf32c4a34c6b41dca11e00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809029, "uuid": "f2b6ca02-9c59-40d6-bef1-e8c30f2ab850", "comment": "Malware payload (IcedID)", "value": "8e2d79cdbb5b73911641972e00479e98cbc2d6dd25156608d0a364d261c11182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809029, "uuid": "7cf09ab5-7993-4b41-8a19-da713bf9a8ef", "comment": "Malware payload (IcedID)", "value": "5fbd27050c32a30f1fbac1b09f827bf8c9d2951d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809029, "uuid": "4464dde5-78ad-4f2b-9f5b-4d7561b06351", "comment": "Malware payload (IcedID)", "value": "c3ee7aa5cad2dc53c32055dc75a3185511821afb4bf1204b3cd3c7484d18eb0a059d5e8bed0cbe25305e39d76fd38a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809029, "uuid": "6abea079-dabf-41b9-9e1b-24314e12928c", "value": "T1381538AE44CBC59FFEA18838DDA46AE3C293976ECD6AC9F34D8594302C114D9487B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809029, "uuid": "7df51087-ae9d-4a48-a5be-698beab0f995", "value": "f6bdd1c75556d961afd6fb8104c342ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809029, "uuid": "ff93a417-6ea4-4554-8cf2-874b8579800f", "value": "12288:HfdCRsouYgpzEvqM8dxJ6IO7ByLErvB67sm:HYRx8V6IONyLErvB6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638809029, "uuid": "63b794b1-a8f5-4594-8773-c80aeaaae2aa", "value": 889473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638809029, "uuid": "9f49aa1d-257a-4180-962f-3223f98a1b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809029, "uuid": "f2a2ce4c-d94f-442a-b824-afb9742a28dc", "value": "loadYouYou.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65474ce0-5697-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638796878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796878, "uuid": "13b27270-d958-454b-acb0-2f9bc9691a70", "comment": "Malware payload (AgentTesla)", "value": "84698543d4a8f2834ba82a3bd31cd6f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796878, "uuid": "22560124-a4f0-446c-9ecf-ecbbf6ffef9d", "comment": "Malware payload (AgentTesla)", "value": "8e8f2b03e1d62ac25c3d95b0761f44a29e95acea37134dc86415e6861b60575f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796878, "uuid": "fcac0221-bbea-412c-810d-e80b3f9fcfc0", "comment": "Malware payload (AgentTesla)", "value": "2dc628daf77cfa3c18f211aab862c07989e6cd60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796878, "uuid": "ce0e19c2-6ec0-42ca-a54e-59627fdf9def", "comment": "Malware payload (AgentTesla)", "value": "0f55a5b8440548c166c8c7b2db44feb5e9f2d940029b63af7c81a01de40fc9c35519e9d0320cf3518ca99c6b40f3efc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796878, "uuid": "2b5f70ec-59c5-45e4-8624-0cbbc3f23080", "value": "T113A4F1873A90A0F2E1395D33BE93941E22633DF4AE61D61D77D3FA1B25712A14E80637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796878, "uuid": "f43389dc-20d3-465a-90d4-8793ff7830fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796878, "uuid": "55084875-3987-4cda-8483-60e47b092cc6", "value": "6144:1SP+Le2kQqvZRHYAKKwGiRVCKMxJVFDkYLjOqL8SlBx+TFXy5G+kexb8Zeyux1SW:OKKT3Z2YXF8k0UY+VZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796878, "uuid": "6e8e6b0e-1fdd-44b0-8abf-065d1a112e25", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796878, "uuid": "ad5f2411-5158-4d3e-9837-845e549354f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796878, "uuid": "a5b3868e-2f2e-4efc-8790-8b7cf39d30ff", "value": "Is Bankasi-01.11.2021 - 02.12.2021 Islem Hesabi - TL \u00d6zeti.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0873a9bd-56be-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638813472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813472, "uuid": "21996dbf-5f2b-4b1f-9dbb-08c1546857a3", "comment": "Malware payload (Dridex)", "value": "4b0474ac07780f4465e4db6767f36c32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813472, "uuid": "c865f4bc-0716-4450-b6f1-6345e79eff86", "comment": "Malware payload (Dridex)", "value": "8ebebc7af11d460ad07f45b922236dc7fa38bfe1776fc938a26636b835aa2c48", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813472, "uuid": "062a4f63-de17-44f1-9092-5b3ff9d8f809", "comment": "Malware payload (Dridex)", "value": "8ade2356b7a4bb3b9e22d620274ecd716a237187", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813472, "uuid": "01869a6e-a77a-4558-8712-3378f9eac3af", "comment": "Malware payload (Dridex)", "value": "c6188c6359a7db60a0205eb4154a8d0b8fa360b38c7362f716930b9601e602bc041df410f8153c09780cd08b2c685fc1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813472, "uuid": "59b0abb9-044d-42e2-a3a9-84c5532a92e9", "value": "T11AE3128DF635282EC2F80C7D9A181AB922C27F41CDE1405B0DD93A3EA761F5B170A47E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813472, "uuid": "54507610-d3d6-4386-aed2-c3ac8b4c27c3", "value": "3072:cl5NK5YO5soOk4gBUYKdbm+QcI3W08+d2nYFn6Arh2WdM8:cl5UH5ieqYLm0JdcYFnjld5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638813472, "uuid": "2a7c73bc-6a09-4c7e-ae4c-4271c2ddaf5a", "value": 155149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638813472, "uuid": "fb24f017-d49f-4029-b8aa-4dda084fedf3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813472, "uuid": "bd0e8324-e07f-46ee-b3a0-1fcd1acb0916", "value": "487682345906688.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bf4303-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638765099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765099, "uuid": "f84783a8-6465-4984-98dd-8b07f98a5bda", "comment": "Malware payload (RedLineStealer)", "value": "009c82f66e07f3a58e46484b00aabcdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765099, "uuid": "b8925382-a829-4531-8433-a4d0de3f03e6", "comment": "Malware payload (RedLineStealer)", "value": "8f373d62df45cf52ac4c5f3cea802422b4e06ee3bef9ad7a95c22ac7383917fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765099, "uuid": "a30c2c70-02e2-4681-91d7-2c85e76dd151", "comment": "Malware payload (RedLineStealer)", "value": "a6336db06bba9a8c078ccf108a1d3f5e812bc700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765099, "uuid": "808057a5-2cc5-465f-9e6f-c02a27404536", "comment": "Malware payload (RedLineStealer)", "value": "fc002919d235ddbbabc35f4669acd76b145fbceda5d8266879382a643e71d778a5bafae402cb4c01b458fbc0048436c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765099, "uuid": "f47eaf95-83c9-4383-b1c5-4aec4c386928", "value": "T17675336F86489E8DE1CA98FD2764F101E04371725FFAA292E13F72224786A07F93D51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765099, "uuid": "361d98cc-80ef-4274-bc76-d684251b10d4", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765099, "uuid": "54521e81-303c-4291-945a-281c1bef7867", "value": "49152:OXm0z2WGMzGSQl3BlTMC8+dJ229LbkNaQ:OWC2yaBJBNM2dJhN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765099, "uuid": "439b24b4-bbf2-46f0-b1cc-48d8fd5392d8", "value": 1598624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765099, "uuid": "1675eaee-1c00-4ebc-ac4c-f138023af3e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765099, "uuid": "6e17f5a4-4e18-4572-8aa9-2099b06361f2", "value": "SecuriteInfo.com.AgentTesla-FDFF009C82F66E07.21597.11967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b126450a-565d-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638772094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772094, "uuid": "d005571e-2cfb-4098-93d3-6980a4c6d7b6", "comment": "Malware payload (CryptBot)", "value": "c132e8f3434a2c4ac1d3479f0e5d2d70", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772094, "uuid": "c016d67d-2510-42db-9bd1-ff065dc9536e", "comment": "Malware payload (CryptBot)", "value": "8f91477ce40680cfffed8cc77a5d67087748f85071d03972ae5bd18357a4611a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772094, "uuid": "6354cc7d-2b7e-4003-8028-b5bd6081dfff", "comment": "Malware payload (CryptBot)", "value": "b6f7eaedefa3d06adb8eb0e80984ee15c3ce4de7", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772094, "uuid": "bf89d699-fab1-4af7-a05e-3e9578da7f42", "comment": "Malware payload (CryptBot)", "value": "42eae5583edfcb20bf5efb181586d05074b411a5264e964a17d85daffa8316dc87e77fc60a3c0615281cb9d972355bb3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772094, "uuid": "1b58e351-401e-44bf-abb1-0670a992d946", "value": "T1F384DF1172C0D033D09364B58D25CBB69E7AB4701B662ACBBBD95FB91F343D2A62530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772094, "uuid": "21984ac8-fa89-4e96-ba14-945b898d0ab0", "value": "c6dd551f3faaabc1b84b7af1e0dd4536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772094, "uuid": "42ec38c1-40b1-4a44-b8e1-c2b62e82f23d", "value": "6144:CSwJTbdflucCDfZzHzA4Ot4xHEZSSRku/pRkdRA11sfm1+hj:CSwJbfuDfZzHzA4U4Na2uhqj/ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772094, "uuid": "7c9f4d75-7d9c-4a91-8470-b4089f7b3456", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772094, "uuid": "f90a8998-36f7-4515-8cc8-1f6bdaa26260", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772094, "uuid": "1ee3bcfe-3ba0-49c1-a77d-96d3a4ac956a", "value": "c132e8f3434a2c4ac1d3479f0e5d2d70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b4adaf-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638772395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772395, "uuid": "597b6025-1875-4493-a85e-d68aeefb6ea5", "comment": "Malware payload (Dridex)", "value": "ada221efca37a367af3fd2737f631950", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772395, "uuid": "ae7ec409-8e54-47ad-bce4-8f165cb52411", "comment": "Malware payload (Dridex)", "value": "8fe046c2fb961ded114076c5dfcbd8459a82baad6fbad34c04a08b920ee6290a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772395, "uuid": "c5f7ef9c-3bb5-4b02-a3d8-48342744a903", "comment": "Malware payload (Dridex)", "value": "947d791982e89ef034b41d15e623b83067bcfd97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772395, "uuid": "5e3f41f0-ea69-4900-a789-5828dbf0e38c", "comment": "Malware payload (Dridex)", "value": "5da529f709568ba058eb351aff921681e24c2e50d6a72d4976f162085fdc3bbc9dd77d1b21ceb1e5ba778adacc752fc4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772395, "uuid": "12b21dd8-6c2d-4c03-a047-f9bff8524fa9", "value": "T1F6251238FE9D5EB3E5094DB280C376B26BBEF4112360D1A39FC6851B1D157E22D23622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772395, "uuid": "823c8375-21a5-4dc1-8d3a-fc4929e61865", "value": "1dbe981f20018e6149347c33c3a54ea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772395, "uuid": "fbda70bf-0742-4780-8aa1-1ba5ef0c061d", "value": "12288:ih8VWwkjZvPgkOCfn3n3n3n3n3nVLFPMdV4Fgw:a86p7tJkdV4Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772395, "uuid": "1adc2c48-98f5-4a2a-9da1-b899dd381b34", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772395, "uuid": "21b6b0d7-3714-4882-b90c-6aaed965cda7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772395, "uuid": "afd7168b-1979-4022-96bb-bff8222ddc24", "value": "ada221efca37a367af3fd2737f631950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfa1968-566b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638778129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778129, "uuid": "ee407a7f-3627-4281-9838-c9090f86e04b", "comment": "Malware payload (Heodo)", "value": "3dde2a073bb1c7fa2c2267907e523e61", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778129, "uuid": "1b8f374c-0dc0-4494-89ee-cd10a6165e4f", "comment": "Malware payload (Heodo)", "value": "8ff02b45da3b74908bb28b5e5d27289a7f7ccb448ae6b51c110c27fb3dab8533", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778129, "uuid": "4ad42ba7-25bb-413f-acc3-6bd75054547f", "comment": "Malware payload (Heodo)", "value": "184c7d25fe9a0ef4a609fa40d6cdd218d82dec66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778129, "uuid": "e487349d-1db4-40ff-9565-ad67fe534d64", "comment": "Malware payload (Heodo)", "value": "01509bee5113506bba19dc6624458f9c33fd98869539f507720bd7b6f89ba03fd59393b8abb91b4c745f06eef9186b75", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778129, "uuid": "eaf29e3d-3d2e-4df8-98b8-b000c171ac9a", "value": "T1C3E4BF11B6D2C032E4BE1134153AABA5097EBC619BB1C5EF63D03AAD5D306C06F35BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778129, "uuid": "e2e1d558-9401-4e61-aeea-f126e9caac9d", "value": "479782c40538d0c8b72b2791f9b6cfc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778129, "uuid": "2234b849-a055-4cb4-aed9-65d32a23bcdc", "value": "6144:31v9X/WHuR1R0bB5HKg0EWBe0uCvn7DOPnAOEiZxuxc16uoSrvNbT3ERN7eo2zbP:31J/WHlN5HKcWEMn708xnuFFHPR101D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778129, "uuid": "09a5ebea-2875-44ba-8d77-1fb2593854f3", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778129, "uuid": "cbc3ce89-1775-4e5b-9db5-6a2a885262b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778129, "uuid": "ad64ac07-3b72-4a78-88a9-e04ef7d1c5ce", "value": "emotet_exe_e5_76cf80ad6c855df2359e1bcc34a02226c40c2c5b1e2f80e3aff328cea2a78907_2021-12-06__080843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ac3b7c-566b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638777957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777957, "uuid": "c9efd577-47c9-4a33-89e2-e1c104c5ade3", "comment": "Malware payload (RedLineStealer)", "value": "470affabeb66a60dc08c77d41f4956e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777957, "uuid": "774756d3-059e-4d44-aeb8-558e37127a6d", "comment": "Malware payload (RedLineStealer)", "value": "8ffa24a981275d475221beac23988667f62a98a4ef19a420f9bb1fcd8a763340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777957, "uuid": "55125a4e-153a-4038-b1c6-64f9841529d4", "comment": "Malware payload (RedLineStealer)", "value": "bbf96c3e3863cea75523c6f127d82af3e3dca465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777957, "uuid": "a519cbfd-d7c6-4c3e-8f5e-291337f51859", "comment": "Malware payload (RedLineStealer)", "value": "2a80985306cfc1c53f1482da803d617c7c5d18cef4b5b9107dbd508ee1d555ac05d8132484c9077ed1cf0052e8840d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777957, "uuid": "72fcb65a-9c60-4ea5-ba15-d21e7ff03eef", "value": "T15C549D1133D0C032C49725768925CBF54E7AB4712A666ACBFBC82FB99F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777957, "uuid": "b3ad1c8c-9737-4d26-9abe-2881d3362862", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777957, "uuid": "4bd908e7-1f0d-4e7b-8a95-e8d52b496a3c", "value": "3072:P3dhzCNSg+h/y7Kwgu39ZF2JiI1vKgTsVK7DVz5UtDKzYQHsj5fjcbY:PvzmxfuaZElTsoDVGtDwH0Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638777957, "uuid": "df2157ca-ffdd-4de4-89d4-eb304c755025", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638777957, "uuid": "bc6641fc-9eac-4394-a76b-18580f6bb875", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777957, "uuid": "583a2c22-c8b5-4ba9-9d6a-423b79d5bdbd", "value": "470affabeb66a60dc08c77d41f4956e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcb6d69-565d-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638772219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772219, "uuid": "df4b35dc-20fa-46c9-9afd-2dec68eaeee4", "comment": "Malware payload (CryptBot)", "value": "243774be521931c4b522c599e41d9d55", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772219, "uuid": "ad0cc2a5-d765-4940-b10f-5d43e919966f", "comment": "Malware payload (CryptBot)", "value": "900b5d260f80959744cacc91041f2e52b28b89f308c4e9d95518ba919e1081a8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772219, "uuid": "3a2e1e6b-3149-4517-a452-4222e7e519b0", "comment": "Malware payload (CryptBot)", "value": "553beda1d6604986c2d441d1ede945a32a6d9f97", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772219, "uuid": "61707f46-0c35-49c3-bcf6-c49596111654", "comment": "Malware payload (CryptBot)", "value": "9aa7049524b2aeb55c15e22129a69ba04dd17a9aa68edde364b6464e5ade893a1e0b3bf9d2c6a9e605f9fdb4a30a91e5", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772219, "uuid": "aee012d0-b451-456a-98f3-d96dd63c4613", "value": "T1BB84DF1036C0C032D05664758D25C7B59EBAB4B51A266ACBBBC85FB91F643D2E73A30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772219, "uuid": "d11afa01-02ed-4a4c-b591-1907710f9f01", "value": "056a8a1a9c4c42207c32f3dcdf651893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772219, "uuid": "71b63f9a-06d2-49a5-a4f1-c45275f4f039", "value": "6144:inp7ASVmmxRDvUUMRRFoaq/3Dsg7kM/Tje+4b1+:inpOmHvCW3wu/XAb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772219, "uuid": "998eb2fd-fae5-4070-9f4a-1109e2ad03a1", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772219, "uuid": "57e63635-8f85-46de-b8e3-943d3332b4ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772219, "uuid": "a9c5c0bf-0a53-462d-8a65-9e0d719b286c", "value": "243774be521931c4b522c599e41d9d55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa755fc7-567f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638786820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638786820, "uuid": "34ffa6b7-620b-4a39-936f-7285242f03d2", "comment": "Malware payload (Formbook)", "value": "4882e78e04800055d96ad5d9c7072622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638786820, "uuid": "ed23474b-0095-4d18-8ec3-fbc319fdcce3", "comment": "Malware payload (Formbook)", "value": "902af41d70f170b165df3bf215109ca0c8225d8c3855cc39754e87be9f4eda2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638786820, "uuid": "86677259-7dcc-49e6-b572-202e4fdf5352", "comment": "Malware payload (Formbook)", "value": "057c9baa6d41d6dbc910e009076f9451cb04bf28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638786820, "uuid": "9f3a3b75-e325-47f2-a48b-e5592dec46d4", "comment": "Malware payload (Formbook)", "value": "24b9b2975e5750e0f20c85a392e68b65f6a83936b8c9c60d2277373b5d7fbfa5390733b6f55b2bc49be1fd16e80da97c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638786820, "uuid": "703ab06c-25fc-4084-b6f9-452a36531319", "value": "T11DC4D061B444F497D8576EB0B82EE37109A42C6FD6E0950C339DBF2A50FA363124FB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638786820, "uuid": "2d66f069-e32d-4c55-b908-3bf7b0916815", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638786820, "uuid": "459bb0a4-d08f-4c96-8df0-f615862f9fad", "value": "12288:YcdzBX31PSg7SAZ/HkP7i95lbygb6pwCZs:Yc/woTZ/bzVbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638786820, "uuid": "0d285e29-2788-4c15-8d10-661dedcb5f42", "value": 561910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638786820, "uuid": "90b2ae08-b652-4139-b136-25592cb530ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638786820, "uuid": "49f735f0-fd51-4c1e-9cbf-cf8b91bcd88c", "value": "Upit_12_6_20121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134f91b9-56bf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638813920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813920, "uuid": "48d16eeb-7588-4e20-b03b-d07114bb7829", "comment": "Malware payload (Dridex)", "value": "c57e62366a298fff9d449a313243a71f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813920, "uuid": "988fc362-fe50-497e-a34b-f1f6ef0cf492", "comment": "Malware payload (Dridex)", "value": "9077b976eda8d9e62a7f6f76e916fd4f68413ae86c20be72bb70232122655d51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813920, "uuid": "3f97952e-7111-411f-ae34-2ba94ad938cc", "comment": "Malware payload (Dridex)", "value": "95f7b84aba9fbd6cfefd613bd71875f3a4fd81c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813920, "uuid": "6b7bb5b0-c203-49fd-b4e5-a28e320e23b2", "comment": "Malware payload (Dridex)", "value": "c2d632cb2c60e727c4a855ebae9e8835a76fa58e2958bfa9ef9925451721ecc90380eba68a724027288795689042084d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813920, "uuid": "a7740bb3-242f-4b95-aefe-97643b3ee1f6", "value": "T1D8D312E5C04CA907F65B3CFDB81A1C78B2664400C054D6AE7CDD7A8C5E923B72E2CA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813920, "uuid": "ef01e8f0-61c2-42ef-b3d9-0c29da11f1d7", "value": "3072:I1W+Mn0EZ2EuJZDlcAmEFn4RCmWGYw1Vk5zCpV2dkU:Zd0EQPveAmqnjC1Qo4dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638813920, "uuid": "9284687c-6773-4348-9599-28a4cea66ac0", "value": 142933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638813920, "uuid": "37ad2378-924a-456d-b335-7d6e0028b4e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813920, "uuid": "901df4ad-0987-4d27-97ef-6e5e5fd7f6b2", "value": "8693107063419205.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43a9528-5696-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638796634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796634, "uuid": "6a3de6d5-fe2f-446a-acee-95aaf2faf9a2", "comment": "Malware payload (NanoCore)", "value": "2eb69b6e0b2057a0483ac1ba5eca62c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796634, "uuid": "1968e5e1-70fb-4e5e-932d-d7cf18746157", "comment": "Malware payload (NanoCore)", "value": "90ef6927186aa43dc96d5d5e258807f1e5347b6432e0c18e2d5a2ae84c9ef80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796634, "uuid": "e19ad8ec-e7dc-42ef-8c56-b223ca01a8fa", "comment": "Malware payload (NanoCore)", "value": "0e316c2d77655f7d42d85283b943c12373fa1053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796634, "uuid": "31eda861-2e4f-4049-9f12-5cb1eea1c57c", "comment": "Malware payload (NanoCore)", "value": "959e6014354ae1d8a472ce067f2ea2a5826a18461f5a65c6260cbede9d71b20426f8bb3c4709081b1cf7d33a862f4b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796634, "uuid": "ec852d70-6d9b-4c84-b903-93968eb96282", "value": "T1D6C26171BFD80D56C8F70A3A1CD1FE344D36B9CE9691C6BF2888E23E7B501900966796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796634, "uuid": "14186b09-1c7c-4141-be07-459ba58955c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796634, "uuid": "35dce447-19a9-43c2-b044-5d8aa9787776", "value": "384:wlaHL9bF/ROQMLlLlLULSbfjc3qA5WuDhO4+99y/CMzqTLwzfWntw+synvoE:wE9bO55YSjcXfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796634, "uuid": "090b92b1-9e54-4197-832d-02ea312a0b3b", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796634, "uuid": "49b85b40-fd9d-490c-a92a-9af9932fa43c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796634, "uuid": "319136dc-8685-43ce-9766-4afb807fd470", "value": "Halkbank_Ekstre_20211102_073809_405251-PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a11ee77-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638802550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802550, "uuid": "7047f1bc-f095-4ba1-b575-b2d2785469f9", "comment": "Malware payload (Formbook)", "value": "25001d12d45e6a6bcc2ab61937ce7545", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802550, "uuid": "b3208774-aa04-432d-8795-c325d70993b9", "comment": "Malware payload (Formbook)", "value": "919efde8447822538f7f2e2016e384028da5ce8945548b6c7a12875ae41cfc79", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802550, "uuid": "0f3e299f-1a20-4a94-bfa6-557c7334e79c", "comment": "Malware payload (Formbook)", "value": "4757539663102d8b4d38661dbb1ca084396596fe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802550, "uuid": "13f03e7f-5c7f-4ba1-92df-721cf7466c14", "comment": "Malware payload (Formbook)", "value": "4eeaa76f6d8f41f9b7b5202b0b06f977aa07d0019e775bd9be3e7a3d50c009c8c108bc7218855dcb78a8aeb7380b9f46", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802550, "uuid": "30153c4b-b22b-4c0a-92ba-481382f3555e", "value": "T1AAC40226E7780A19C5AA0BBEB4B581244B3FA116D4BBD34D734E14DE2FE73418A023D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802550, "uuid": "e81ca778-89c9-4b78-9e46-16ddc178ce48", "value": "6144:Sufs4jGlI9TQ0Gu9zS8eY6iLqdcJ76bDERErufatgYgWh0LA9OBN7Rc3FZksAdXh:SZILZaqfMTMB6DNlt0cgYkeAtVAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802550, "uuid": "da97f236-ed9b-4424-a538-88ddae646fcd", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802550, "uuid": "043427fa-bf13-42c9-84d3-da1639c23963", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802550, "uuid": "9f4dd20e-261f-4e0b-aa86-362a53e15f18", "value": "Vija Product - Overview aiHit.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47aeb4d-566b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778193, "uuid": "39b8180d-03dd-4a6c-9aa7-cf1d6c23a9ff", "comment": "Malware payload (Mirai)", "value": "fffccaf8b00f8cdcbdc900a7e92027aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778193, "uuid": "96646f21-19ee-46f4-a0a1-31d93c3c40c1", "comment": "Malware payload (Mirai)", "value": "91b73669ae38fd31daa12a90ee83430658850eefd441c6e371b6e878de106114", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778193, "uuid": "19f3aaa2-5be6-47fc-ad95-0a40cb0d69fb", "comment": "Malware payload (Mirai)", "value": "19cfb7cacd5542a7d516b8560237e8df3222c837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778193, "uuid": "806ee431-2688-4b16-90fa-f54fa49ad037", "comment": "Malware payload (Mirai)", "value": "81162d3f63d972386d6e810b6bbf27c4ae8a5e8b945256e080b78a18b4648ab29fce7489e47bb69f6b8b1bb5c50da1e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778193, "uuid": "3446f7a0-362f-4669-873c-7afd0304242b", "value": "T1F473015284282C9AF1753F36CF980613A47C1AB5D1A7316B620D0640ABEB647F4D9ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778193, "uuid": "e35d83b7-19d9-4a06-af5b-81c23f9ecfbb", "value": "1536:yzCBQ1AqFHoOOJhVgGEDZT3srCKOLlm7jH+mQlDmf8Y:ICB/qmphaGEDBcrULarx3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778193, "uuid": "ab694aec-be60-4d35-a13c-9bf20d4fd908", "value": 78164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778193, "uuid": "0824bde2-8c56-4099-8cb5-737c0966d704", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778193, "uuid": "53c42e75-056b-4aa1-8dfc-30b3a4b66ba2", "value": "fffccaf8b00f8cdcbdc900a7e92027aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e51b9d3-5662-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638774183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774183, "uuid": "07330f5c-b33a-4b19-bcfd-d86e4c9b1dee", "comment": "Malware payload (Formbook)", "value": "3c34fff9a8a4047126882131e24da454", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774183, "uuid": "0a08929d-b129-4bb0-a2c9-eb2f8aa724a7", "comment": "Malware payload (Formbook)", "value": "920b2a34a93f5add23dbc71393cda484518b2a23ced20e57864a069469999999", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774183, "uuid": "e54c5fb3-b9e9-457d-8a0b-e24c9da1853e", "comment": "Malware payload (Formbook)", "value": "71764d7a1c5a3c64047b9c2fb834fbaadea693b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774183, "uuid": "e6c605bf-3b97-4712-a71f-24b97d39189d", "comment": "Malware payload (Formbook)", "value": "3bac74a0b3bf0a026a3d4594596bca62b8ed04483131207a95167b10af6b4aff848832c147ac7187329baec69bea58b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774183, "uuid": "db6d1750-d37e-4c37-9ef8-99ce2c5c72da", "value": "T195949D8126C14F11E51D997E942D91B83CBE6EBCE1714C4FCF493E35F4796BA230AA09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774183, "uuid": "54e990c2-594b-4c40-8ff4-838870f2527a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774183, "uuid": "a6259a6d-4917-4a37-8ef0-14ed677e5548", "value": "6144:CGinGW22C23TMNnPp3CUPx0ePIzeJzRNf/ddxqM7lshVXP4R/SMoH:GTR4xPp3nxTbNf/dC4Z4M4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638774183, "uuid": "f016cc68-8563-44f9-abd4-8215a60ec50a", "value": 422554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638774183, "uuid": "e525b225-df07-46dc-827c-d7e11f5b6d81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774183, "uuid": "bb2e6883-98a3-4cac-aa52-9b5443c981dc", "value": "3c34fff9a8a4047126882131e24da454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02202495-56ae-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1638806590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806590, "uuid": "9e3cac3f-b6d6-49f9-951a-1c2dcce17b97", "comment": "Malware payload (Gozi)", "value": "7acfd2d92dc419ef41670106fde140ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806590, "uuid": "25362ae1-0b06-4d5b-8c99-b4794e405762", "comment": "Malware payload (Gozi)", "value": "921a140cd87ab040d1b96e8b1e4a04023ea4f5543a887ec464258da58cf7d47e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806590, "uuid": "d81bf9fa-3383-452d-bad9-fe32eaa1b054", "comment": "Malware payload (Gozi)", "value": "713ab6f88c9d946f2a893b5c0c47de515bc41998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806590, "uuid": "14016bd6-bb6e-48bb-b797-f881b7c69c52", "comment": "Malware payload (Gozi)", "value": "f9e47254d8e5ca6aa28107450935b455100809bc644ff12f84a0f5b95029045c5089ef5c747270e956bdf332f582f2cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806590, "uuid": "67e55c66-f121-48b4-a9ee-0bc4466af37e", "value": "T127347E6AE2E51995EDBBD5BACD83C717D7F234450A64D30F53B0CA9A6F43321B218382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806590, "uuid": "527cf188-74ee-46e8-a1cc-0698fa4d68c7", "value": "6144:MW/TYr/Pbqk2ZFOY/ybb00h2ETEzIwtHWtBk4S3Uh:MW/TYLPbqRul5dQzPtHWtBC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806590, "uuid": "9f1864a0-86a8-433c-a02e-9021676d7c13", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806590, "uuid": "cb780295-8ae5-428f-9bb1-6d240cc7d206", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806590, "uuid": "3f1dc56d-7497-4ce8-96b1-09638a4a6306", "value": "17f34f40000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6a6e5a-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638802552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802552, "uuid": "2eb9d794-d4d0-41d3-8544-b1b71680ced3", "comment": "Malware payload (AgentTesla)", "value": "9d08f3dfa1161ae1dec6fbeb22a38680", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802552, "uuid": "a65c579a-c78c-4fa2-96b9-900e6e4350ce", "comment": "Malware payload (AgentTesla)", "value": "92cf0795d3f876b6390d80d405c4c71028be37109157a57d5f913386f6446e7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802552, "uuid": "c167b5fd-2213-4a82-a46f-52973b285069", "comment": "Malware payload (AgentTesla)", "value": "3a0f34c113a8593d72fc5e546e9e6aaed6e8b10d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802552, "uuid": "39a105b4-61b7-47e8-ab46-75ae01d3668d", "comment": "Malware payload (AgentTesla)", "value": "3010c30a89bfb880219d720442bb6cfdb6d4446f51b877f3e59d2ed34cc28601f913eca69f5ec0de3a31c3d5bae7d221", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802552, "uuid": "41a6d19f-4956-406c-82b7-f9fb4e19692c", "value": "T1DFE4F1923298A796DC791BF50822908013737E1A9964E71E7CCE32CB2F377525713BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802552, "uuid": "c311586d-2506-45f2-bc8d-ebf8ded6b6b6", "value": "12288:RtD00jVTjWXkd2yMlPW6ssx2WvU3yGUKAjcJQ5bLlyGav8g9n0Ry1:RC0RTsLFFx2UUvUKAgIvmhnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802552, "uuid": "a65cf770-a22a-4f23-b4c9-1b22a2da9fbd", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802552, "uuid": "3ca6fa59-8ec9-4f40-bfe2-76da47a6b987", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802552, "uuid": "f1e96d95-b8a4-4920-bd6d-23c8b5b2f800", "value": "Waldo Orden de Compra -SA112421,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7ae626-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638776118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776118, "uuid": "368f1f78-85d2-44ac-ad18-1eb168c34910", "comment": "Malware payload", "value": "5947e565460b0579747a95ca88f049b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776118, "uuid": "8a0e605d-1264-40f3-ae19-48e5de6a9750", "comment": "Malware payload", "value": "92f757633c618d3e8bf94956fc975b72a41f2e0620ac2dba6ec65e7e9f09ecf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776118, "uuid": "8de7b040-3e2f-4d74-81fe-cf07f95f59e9", "comment": "Malware payload", "value": "b12f4e4e3d963e8d2a1455edf3aaf605a00ce813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776118, "uuid": "2d2d99ee-a7a7-43c0-92a6-161732485772", "comment": "Malware payload", "value": "f05349cf779f69bb4298c82a9fb15ebc76e801b2a7f737e7d44db5c75a151880b4500fbeaf175d8f0cb78405280c6778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776118, "uuid": "bb65dde9-c3a1-4fd5-89f0-e8e45b42cea3", "value": "T1FA046C2162C0C132D1A738758169C7B24EBE6472526A6ACF9FC55DB47F78BC2E23530E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776118, "uuid": "e3e97a5b-a91b-41d7-96e1-05d5b35a9879", "value": "3072:A2m0WR1S7GDi+tsF4BNZSpuJiSqlPfg2IdRT9wp:A7pq6DhtHkQt2gT9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776118, "uuid": "4dd5ba1a-2f8a-4e80-bfe4-83dae70e6f6a", "value": 173500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776118, "uuid": "a84da22b-0695-4092-a717-225c6d1a7206", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776118, "uuid": "9ccb08cf-3ad6-4152-8cb2-6937d3c30119", "value": "5947e565460b0579747a95ca88f049b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7815da43-5687-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638790037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790037, "uuid": "2f268c15-ddbe-48a8-8122-7c41d152ad77", "comment": "Malware payload (Formbook)", "value": "42d8bd5256a148bf706a56841a97a280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790037, "uuid": "685c8d94-14a8-498f-93f2-db9a85583a6d", "comment": "Malware payload (Formbook)", "value": "93360bc4a370d454533b778b6a589fc9ac51ac3e9490546c2959f33d5da659c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790037, "uuid": "54627de5-e553-485d-b50b-08361380c891", "comment": "Malware payload (Formbook)", "value": "7fb85013f9670936899651de8a347ddba58fd11d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790037, "uuid": "a2f88c87-5966-4c6c-b38b-ae64a75af0fd", "comment": "Malware payload (Formbook)", "value": "a36021dd41e0bfd071b024142402f71dd1fba6ecdf230dbe5cddf1ef37ab3d44b98367f6f0dd9181708005bb71bc19b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790037, "uuid": "fcfdc165-224a-46cc-9585-7cc7ca74220e", "value": "T1D674231BB4C14E37CCF40732657FE3E9D774B995105D88272BB86E1E4E30297AA4DA82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790037, "uuid": "d12eaa20-fd86-4e26-8f6b-fc34088a9bc2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790037, "uuid": "07a4b345-c7f0-468c-b8e2-56f1a56ccdc5", "value": "6144:rGinPSxHe9O+wLIycty0iGmPtT78iG2gu4SMv2vd9g1+7G+AxGLPl+:+OO+wLIjy05mVT78q6SYZY7G5Il+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790037, "uuid": "6c16df14-c288-4070-96d3-1272be5041a4", "value": 360414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790037, "uuid": "932b7d48-e30e-46ea-999a-86d78e3f7489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790037, "uuid": "183672bb-5cba-41b8-839c-3bdd00c0e1e4", "value": "PI EGM05160 LC90 R12-6.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a302a8d-56eb-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638832829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832829, "uuid": "e9040794-fe58-475e-95a0-705e83a15bdc", "comment": "Malware payload", "value": "a051cc64e345d440606d3c28463b8f95", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832829, "uuid": "0086d215-7bf4-43db-b445-10c8fe4d782c", "comment": "Malware payload", "value": "93e1576fbbdd4eb68ce942171651b0104372a0c0e0508af1913b0156d1c7fd86", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832829, "uuid": "14e37af7-2e7a-4d48-90f1-e4af92211d58", "comment": "Malware payload", "value": "6b9b0f27d8c8e2816b7d344a6b547a74e534c765", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832829, "uuid": "9f310ad5-3a14-4e40-8cbc-c46fcb09ac93", "comment": "Malware payload", "value": "a40e61e8737ad52f15d69acdfc4791f066bf225a8cbe47251e5937575aaa7b963700e047ed1d7980caf2744cbc993e4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832829, "uuid": "a48f3e68-8a21-4db8-92c1-e6856f4097d2", "value": "T119C4DF123180C036D2562534896AC7B14A6EBC7567A2E9CF7BC60E7F1F29AC1DB3435E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832829, "uuid": "2ee83f11-33c6-48f5-a619-7855afc392bd", "value": "b5a3d905d84ced323a50ad2f6f85e241", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832829, "uuid": "733eb1fe-2327-4206-be38-f58d77b598ed", "value": "6144:hUWlNW922k6m9dQGfLWLTdDlwgbhzjnU5XdnsYHGuJDLhQ42:2WlNW922k6BGLWAKzA1dnLR3hQ42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638832829, "uuid": "88d198e0-f788-4689-af51-b0f73196c8f2", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638832829, "uuid": "f86fc6fd-30ca-4bdd-a5e6-93eb90485be1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832829, "uuid": "4412d4d7-4b5e-45a8-8c4c-e16b89fce836", "value": "93e1576fbbdd4eb68ce942171651b0104372a0c0e0508af1913b0156d1c7fd86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a883686-566e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779197, "uuid": "a638112a-7b9f-4f5b-810f-b586b9b1c12f", "comment": "Malware payload (Mirai)", "value": "51344c16aa8ebc555215363533be09c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779197, "uuid": "b80a6657-2df9-4e22-a921-fc204db90746", "comment": "Malware payload (Mirai)", "value": "956c66984069f0e4ae6328f1382b8c163e63444139cc9c5d6fb1b16636c8c2d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779197, "uuid": "08cd5b4d-0e24-483b-99cf-baa0c72e45aa", "comment": "Malware payload (Mirai)", "value": "185639da9bc0d257b39ac7ebf3e61344591f2cc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779197, "uuid": "c1b0594f-2627-4bec-9601-2ea909beae6e", "comment": "Malware payload (Mirai)", "value": "6afaaed23a641ad46d6d8fcedbb8647f9c64a313d723b3d2ace989a1613652f5affba17f32b4a3faaaa18bed065c5617", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779197, "uuid": "919b2329-9ab7-4deb-b61b-8b744f2e4d33", "value": "T1F433F2D9A72610A1CC25A13D51F933D23A2A35177E02CFEA7BFACE4B4D065183D5B6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779197, "uuid": "b325f4c8-c9b6-4586-bb94-e3c6a1c6f45f", "value": "1536:pe7Yck/zjED3SZNa/M9iyZORC53YtkQoBVJuD:kYR/vEDJ/McyZORA/JVQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779197, "uuid": "a02945d1-c740-4605-a9b6-8422d8eb9ee5", "value": 52484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779197, "uuid": "eed8a25e-20d3-4b17-8a81-b409e96417a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779197, "uuid": "dce47320-ee79-4183-b741-3385b1238c06", "value": "51344c16aa8ebc555215363533be09c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7ae872-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638760434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760434, "uuid": "0192f320-70c9-461a-bd5e-91e2dd2102e5", "comment": "Malware payload (RedLineStealer)", "value": "ca339283de52398f22e9184ca8d4a7bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760434, "uuid": "bda7a93a-389d-414b-8b8e-5110d567cca6", "comment": "Malware payload (RedLineStealer)", "value": "963a73a00d5a09138b610d7a2a8cca387bced6b67c918a7708fb74bd88ac0c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760434, "uuid": "9ee06920-bb03-46ca-9f84-f6fc4c52f87f", "comment": "Malware payload (RedLineStealer)", "value": "5ee9e1d2aa7e684db93c7aa485e0506cbc9d18dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760434, "uuid": "c3b1b076-77e2-4eef-8773-9f3eed05a496", "comment": "Malware payload (RedLineStealer)", "value": "8b225e2a1cec41a73018d0f16cac636de4c5f978377fcbb6083943f040fca78d0aaae884abbb293751bf234509ecde2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760434, "uuid": "319d9c4a-b52e-45e4-a7fd-d1e8c435ac79", "value": "T13A254A2976E29949C2AA17738129C44497E5DB501263E3E5F5FB23932F8B3B10FDA3C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760434, "uuid": "0ffdc925-759a-41a5-829c-f42025edf8d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760434, "uuid": "b1d35466-27b6-456d-9aac-c915a7b1788d", "value": "24576:bXgaJLNoDefmlGWMyKzU7DHevFson4lw7DOwna:bgooDgyKQ7rKsPl0DOwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760434, "uuid": "02b5696e-c20d-4d7d-aec2-a993b881f8b0", "value": 1020632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760434, "uuid": "311aaa8e-82b1-4538-8690-7240568415e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760434, "uuid": "f5f1ad51-5b71-4e05-a9c1-ff497a8f0b81", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.7829.15665.1567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b55803e-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778258, "uuid": "198bee25-9732-4b75-8f40-1c0d3075445a", "comment": "Malware payload (Mirai)", "value": "c1555c422671354008dfee8704460f9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778258, "uuid": "4ffd950c-1a35-436d-8e59-374402764617", "comment": "Malware payload (Mirai)", "value": "964f3df4c358b1c038814eca51f80c06de38fb71e4eefd80ee596818e78f20ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778258, "uuid": "6739c72d-0ddd-4e09-a432-1eb8e45ed677", "comment": "Malware payload (Mirai)", "value": "4aad9502a7c64f0104c890b8ad0c017dac81ff45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778258, "uuid": "d9e51210-dcb1-4700-b996-c789dc367cc1", "comment": "Malware payload (Mirai)", "value": "5d9d8330e1b63cac276f3eace80828dd3a8f1e3add139a90f762de302129e674746b9550a1a83383cb99d47dd1b7d5d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778258, "uuid": "d2f9a38e-7b2a-46f0-8b68-002e839f2be4", "value": "T109C3BF32C9782E99C1016932B4B4DE3E5713A94056132FBBA0C6C66D54E3EEDF6293F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778258, "uuid": "339bc078-26d7-4f9d-b2be-7ec886a74b92", "value": "3072:euyIE0fggggkZhyTd4Yi6zcV8sfl0D+MphfV:Vy2ggggkbQFAfMnhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778258, "uuid": "833eccf8-a266-4c3c-b4d1-50f508da29b1", "value": 120548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778258, "uuid": "ef235708-a853-4ff3-a495-481738244183", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778258, "uuid": "f5af780f-53f2-4c4b-bb7b-e90b2eb36ca1", "value": "c1555c422671354008dfee8704460f9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf03d6a-567d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638785829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785829, "uuid": "b74e81b9-4fc7-46da-b7b1-fd72fdbbb872", "comment": "Malware payload (RedLineStealer)", "value": "ee94626d202d4e1a4f139782fceb3fe7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785829, "uuid": "1569da04-3c2d-4a2f-bd9e-c124f38fda15", "comment": "Malware payload (RedLineStealer)", "value": "968b304a4caec712ee805974d3cd17cf9930ed470ace4af8d316970c4ca99dab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785829, "uuid": "9ebbd5d5-b774-471e-964b-8ca23e3eb874", "comment": "Malware payload (RedLineStealer)", "value": "c57bea4a1eb5d5530ae395fa483597a65b196846", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638785829, "uuid": "86408ab8-4870-4886-8122-43a1073bc2a4", "comment": "Malware payload (RedLineStealer)", "value": "3442ea575a150007eac423b1ca3832e09398d53dc089af0ba7ad30c859b8b8a264cbb0ffb78adce4a40c82f41b719ef4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785829, "uuid": "338ec4e7-37c0-49bc-a6b8-2e44ce46747b", "value": "T112A33A5437CC8A15E6FF0E706CB0515983F0F5A36412E74F4DC558EA2E62B81AA27AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785829, "uuid": "711af29b-b692-47db-933e-a85db4651d3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785829, "uuid": "80bd5510-4827-4d4b-9dcc-34af2f61a7ba", "value": "3072:+DXzD4w3M0eoAFRLUh7gOyhIge32bI9vUaH8k:U4sM0eoAFEvC08k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638785829, "uuid": "6f763b06-dd51-4428-9bdb-19868f1476f2", "value": 106720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638785829, "uuid": "d2e02570-a588-40d3-abbc-b269aa616361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638785829, "uuid": "e093a3c5-b2d3-46f5-9aef-f25f4c8597c5", "value": "ee94626d202d4e1a4f139782fceb3fe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196a18a8-56c0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638814360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814360, "uuid": "7cd9ada7-a677-47f6-ae42-490af3690095", "comment": "Malware payload (Dridex)", "value": "8aec19109b57c74cb67d4b89f3b0803c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814360, "uuid": "0e505559-bc10-41b1-bdd3-dae0ae6e13df", "comment": "Malware payload (Dridex)", "value": "970a783ce4bb121f6691c684cc00b3c3ec159028d4b1fa39d1f9f13d31fac24f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814360, "uuid": "8f404233-7605-40ba-a4a6-5d59495223ae", "comment": "Malware payload (Dridex)", "value": "10341b41efd4e1f33da5064973521cc61c7ee3de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814360, "uuid": "2e42c4bf-6ebf-41dd-97ae-144ac9acc478", "comment": "Malware payload (Dridex)", "value": "9db0b2de9c44162e9d0021afa8e386e895b3cc9cd095b7849065c2a649e87f761e5c19370cc8f9be49cd9ed3c871f955", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814360, "uuid": "1f26db28-c4c2-4444-b38e-7e2bde561ad2", "value": "T1E0A3025ED397F020C0EFC976462F6CB8802B75A29544E1F37406AECC0B5B85EE9B656C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814360, "uuid": "7e37498a-c847-48b8-af00-557d35fac7c7", "value": "3072:qDY007Aj/Vl1td/fKxSKREvpER3yPpIMoMG64zp2xd88:qDY0qAj/NCQBI3TMoMuF2xdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638814360, "uuid": "69ac8dee-e2ca-4eb9-ac63-b5e25977c70f", "value": 104556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638814360, "uuid": "f6b78513-934d-4789-94ea-cb51c92cb7bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814360, "uuid": "7bf230c9-1f5f-4968-9ce9-60fa03e89444", "value": "INV 113836873.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795bf6d2-567b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638784885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784885, "uuid": "504c52af-8e44-4a4e-9b80-ee01477251cf", "comment": "Malware payload (RaccoonStealer)", "value": "67573a2c0ea3e79cd7bf2339b69aac20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784885, "uuid": "b249d9a1-b4cf-4848-80f4-dca642cd25c3", "comment": "Malware payload (RaccoonStealer)", "value": "972b5ebdc8a6dbbf4e3033d3053cc3ba5fecc429af0c4fa020213e3c621504d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784885, "uuid": "e2785e80-da06-4e6f-a599-cdc4760104b8", "comment": "Malware payload (RaccoonStealer)", "value": "95c114d83b78a34f217d30585d2e2bb07cb61bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638784885, "uuid": "026f9604-5456-4cb3-89c0-f8d2ef5c4bec", "comment": "Malware payload (RaccoonStealer)", "value": "b1a17670f25b49bc03c9871df3cb29fe8adfa569c86ed9dc35d1b0e739c2f71db316d24801f009867d2862cf19b0f1e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784885, "uuid": "746334b1-096b-4fbc-8c2e-a11207cd34a1", "value": "T1B254AE1133D0D432C59725768925CBB58E7AB4702A666ACBFFC41EBC9F247C2A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784885, "uuid": "39496a27-2ec9-4582-9cff-9df21c868fd4", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784885, "uuid": "f741f136-74fb-4102-bdb4-870f64c3d120", "value": "3072:73dRzCNSg+h/y7Kwgu39ZF2JiI1vKgTsVK7DVzm2egMR2jQ4FsdQHPj5fj:jrzmxfuaZElTsoDVrerR2jQmBHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638784885, "uuid": "e78e0a77-4af2-4087-a513-3b4ea0e7b1a5", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638784885, "uuid": "08bfeb22-ee5e-4da8-b531-71c445587776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638784885, "uuid": "799b7332-48a3-4ec5-b5c2-f65f2269f1c4", "value": "67573a2c0ea3e79cd7bf2339b69aac20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704e56de-56de-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638827390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827390, "uuid": "7b135232-0e49-4332-865d-cac1aee8de54", "comment": "Malware payload (Mirai)", "value": "38e04eeda9bd770ad86d9473d5bd4f27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827390, "uuid": "ed264b5f-e172-4aed-b90b-1ec20baf6a09", "comment": "Malware payload (Mirai)", "value": "99eeac71d966e4fa50f7a6034835a868b7b88187513301e610aa1797d1cfd791", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827390, "uuid": "585177c0-f3df-4593-bfb9-b800e47dad2c", "comment": "Malware payload (Mirai)", "value": "21d10f46d54f2e2e1ad28f0d1c6aeaf540946f84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827390, "uuid": "0ab55fa7-187f-4d90-a73b-f0f14e256046", "comment": "Malware payload (Mirai)", "value": "064788978af56210cc0b9b0a9dfe641372e2f46cbad57018ae5d04d09b1d8435005566363e4311689981c81899b7a545", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827390, "uuid": "2759c18c-d674-4c07-8020-3fb658a6e8ed", "value": "T176D2F1D9BB92B35EC040503748B68E4C95F8AC766B5F8B476D9C358ADE4707813B0B0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827390, "uuid": "7e487fa4-5e58-4187-aa7a-19c89349d674", "value": "768:rzW8IjJ/H/Ti+/oFoGKG0wYLiCHtkx/oEIvYPmGVSOCsVyOYGP0:HWRfTi+/oy7FHsjRCsVyhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638827390, "uuid": "3acc08f7-d889-4e1e-9f61-528250891d6d", "value": 30844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638827390, "uuid": "eaa3d5a0-e4d7-4916-806b-e1656993f2bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827390, "uuid": "ef893696-5826-45cc-bd6c-b187b4bb3380", "value": "38e04eeda9bd770ad86d9473d5bd4f27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c408a1-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638773097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773097, "uuid": "749af42c-d7ef-49bf-88b9-56688c4475c0", "comment": "Malware payload (AgentTesla)", "value": "e184a11c074c88d402c23c6c82fa72ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773097, "uuid": "8197fc88-5109-4872-8a72-9278469b3688", "comment": "Malware payload (AgentTesla)", "value": "9b631ebff6e0a18df03694b833b680ba568f0c760427a8f1d54973ab9f4698c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773097, "uuid": "bfec96ea-0133-44c6-bb28-705ad39673bf", "comment": "Malware payload (AgentTesla)", "value": "7ad857cab71ede31b7e54cdadfc458d0b858410f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773097, "uuid": "5bcd6904-ecbc-4ea1-96a4-38d68c5e5d04", "comment": "Malware payload (AgentTesla)", "value": "d325ddb9b14910f38ffb8d316f91b71753648c47fda37f70e6b7ebdf0361a9a3aa0a2564cb2b62ffffc836130282dc20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773097, "uuid": "fcbccc63-e20b-4db1-b8ba-9f21f9630af9", "value": "T10E557A2C22B5086BE97C1A75042547374EF26C3D997BE3CD3748356B4BB26844B263EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773097, "uuid": "ccf79d59-e7cf-4101-a551-264a5fa931fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773097, "uuid": "0cd03d62-5631-49ab-b8c0-d3967d2c4d8e", "value": "24576:VoCQCQoihhk4qPJqrCPV3ck8o2NZNYpc3azC1LS:Moir3UqrCdMk8o2lYS3zLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773097, "uuid": "2fb3cacb-5555-4ae1-9be1-24fdb1a1ac9f", "value": 1338368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773097, "uuid": "217c02dd-2260-4344-a590-803922909bcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773097, "uuid": "0e59c7a1-0f12-4c35-b55c-d31455343adf", "value": "Maersk Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea7881e-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638760440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760440, "uuid": "fb3b8562-91b4-42e0-9f95-59c11c2a25fc", "comment": "Malware payload (Smoke Loader)", "value": "db9a089c112621e85cc2d4c80fed0f18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760440, "uuid": "d38a641c-0381-4488-a1d1-2d7fc6454e08", "comment": "Malware payload (Smoke Loader)", "value": "9c53ac5c4df5af245263ee0d01c159378b285911fe85e10b7669b9224570a5dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760440, "uuid": "07490a55-ab44-4e14-b4ed-98abff283f22", "comment": "Malware payload (Smoke Loader)", "value": "da57e61cdd11fb924f5db5a4b093c25d37f040cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760440, "uuid": "3fba869b-15a6-448b-a63e-6eecdb58632d", "comment": "Malware payload (Smoke Loader)", "value": "74bb8f3433107bcb2d68d3497ebda53595cb2e439cc1b583f3f516c5c2ec0f96089699273dec9d88c429a635e9f6b036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760440, "uuid": "e2a9cc1a-9813-4a01-8f9c-bcdbe86ef4d4", "value": "T10BD2CFEABD6780BCCDAC80F398E706FE92CEA1B4B4460249D55D2A7679C137C807970D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760440, "uuid": "c36dd1e2-66f2-4537-bb0a-9654a38d8236", "value": "768:aOsIP7IRNWUlaMijihcIGfTAy95w5HUWCvgnvh5gG:axYfMmiokyI5HUWAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760440, "uuid": "20b9934c-ae19-4bba-915b-a3ae546ef73f", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760440, "uuid": "dcbc850c-a31c-456e-b307-3cc63ca5491d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760440, "uuid": "cfc0e621-67a7-4bb3-87a6-9300d203d5d8", "value": "SecuriteInfo.com.Trojan.DownLoader43.47262.3065.14577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23e6693-5649-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638763560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763560, "uuid": "7e735079-2ced-405d-8534-d0ccc30196e1", "comment": "Malware payload (RedLineStealer)", "value": "ba0688708930efd7e49450a571c844f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763560, "uuid": "146123b7-74d3-4c07-aaa9-55f0cb94f1c7", "comment": "Malware payload (RedLineStealer)", "value": "9c6fa478118c7e8e76636754a40396924323fa5731609ded0d1b44113db461e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763560, "uuid": "3c52ad2f-1b08-46a8-a5f1-08764b7777e3", "comment": "Malware payload (RedLineStealer)", "value": "a3e24b30dd2d16030204e3a196c9ee0be8ac76b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763560, "uuid": "cbc25a5a-859d-41b8-99cd-2f88abbf66ed", "comment": "Malware payload (RedLineStealer)", "value": "f69dd187ad5f46f1314af31f40285b57bc9925b874a5de3431015294c684e55b6f47002dd8a596ece58a96df3a4d6e5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763560, "uuid": "d149466e-1416-432b-94a6-b35921dc4395", "value": "T1D1549D2133D0C032D59725768525CBB58E7AB0711A6A6ACFFBC81FB89F247D1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763560, "uuid": "6bb33559-ef2c-4d03-a4ee-30b811be394b", "value": "6c355763d97257cce28120024c0d5f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763560, "uuid": "b424704c-ee7a-43f0-9fc0-ed97f46a0c55", "value": "3072:0i9tAasjGN1VIyKZgui9ZFoJiz+iKghFOhrDVQeCcA/XbNEPVV1xXKQHFj5feC+t:xbADGTadmZZ/hFADVV8/rNOpHLwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638763560, "uuid": "c2d22afd-479a-4b94-a439-4d7dbf5936c6", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638763560, "uuid": "0dc0db54-6a70-4c96-a9bc-742034f93652", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763560, "uuid": "575f356c-ca13-461e-b694-da507ec2aaf1", "value": "ba0688708930efd7e49450a571c844f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e3418b-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638776291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776291, "uuid": "9f115bb7-5429-405b-9348-883b02f9ccc8", "comment": "Malware payload (Smoke Loader)", "value": "4f32a253f72a4603f213c943a422fdf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776291, "uuid": "8aaa9c46-288b-46c7-9fac-0312cafed716", "comment": "Malware payload (Smoke Loader)", "value": "9da9adc5843c38ad49875dc106533003fb364066af2b5c2c36f6b5381d04d1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776291, "uuid": "de513c6b-c4c8-4dbb-9b8a-2139fe00a81b", "comment": "Malware payload (Smoke Loader)", "value": "5c6c2e557e082df317f0c9c07f9df886ad6f210d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776291, "uuid": "21e57626-793b-4244-bdbf-6432e13f1fbe", "comment": "Malware payload (Smoke Loader)", "value": "860a71eccadc7159a8c58cce9e903e90834d4fde18fdb9d931312c97261acd5d8ce55c22196c185a3c296f34d25302ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776291, "uuid": "e97fe629-46cd-4a7d-9729-12bfa8b1fcfb", "value": "T11854AD2133D0D032C59729768525CBB58E7AB4706A666ACBFBC41FBC9F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776291, "uuid": "72f8c785-e70d-4fa5-a436-963e0a52f878", "value": "6c355763d97257cce28120024c0d5f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776291, "uuid": "ebe13ed7-b468-400d-8a64-63a0f6c3ce9c", "value": "3072:ee9DAasjGN1RIyKZgui9ZFoJiz+iKghFOhrDVQx+jRzKlktlbk5BQHCj5fee:f9ADGT2dmZZ/hFADVC+j7omHmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776291, "uuid": "ea6ebc81-505d-42a7-9633-a990851a2176", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776291, "uuid": "a41873c2-c3b6-4171-9107-30c19cb22d93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776291, "uuid": "a283f027-08ac-4109-b63e-20ac3397926f", "value": "4f32a253f72a4603f213c943a422fdf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6261b5a3-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638802456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802456, "uuid": "bcb8c203-492d-4a74-9a0c-de63b624f96f", "comment": "Malware payload (AgentTesla)", "value": "7c49d1a29220754312100b0198897a85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802456, "uuid": "de5beeb9-c7ab-42f5-bd74-7b3da92c3de7", "comment": "Malware payload (AgentTesla)", "value": "9e52450a9320cb2919cf963cdc239cdbf85efe224910e2f25d74c0ef495d7f92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802456, "uuid": "5e69c9f4-b990-4f4f-b6f3-43ff76f53c92", "comment": "Malware payload (AgentTesla)", "value": "69eec26407ab8a82a1aad1199c5a754b7dc86f3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802456, "uuid": "432f2ebd-e06f-405e-9221-a9f1424d437b", "comment": "Malware payload (AgentTesla)", "value": "1767d9747a30dfd648413dfd07ad09e2d1b790f91d229f0badf1a3943a7f72a05575cc40c46bdc2ccbe9bb5839852bca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802456, "uuid": "d397a32f-e2b0-43d6-810a-3c6e69fbcd98", "value": "T165F4BFD2565A0191DB67CA70386275AA23EF5F8EFC08F58A3B70B05C1373DAA0DB5907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802456, "uuid": "ecb4124e-43da-49af-a8aa-b5d017a9ea23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802456, "uuid": "053d5abb-745f-4c38-b8fc-2cd2a5946a08", "value": "12288:kLOqMF04ixBFmvd0e5LqH89RJJ9gTrL70fv1yqOpZWHr7O7Fss:kLOLF04i1emeAGRdgrA1y5a3O7Fss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802456, "uuid": "23b02be5-444a-4258-b230-3292b32a77a3", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802456, "uuid": "f1fb2cd1-696c-49e8-843c-c7cd72ffd57c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802456, "uuid": "07e29f35-5ee5-4f93-bdaa-f8f709947cbb", "value": "Enquiry Order.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9a7cef-5685-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1638789401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789401, "uuid": "7b1545e5-5645-42af-bccc-046559bc29b6", "comment": "Malware payload (AveMariaRAT)", "value": "28241aafe5b6018c984e310c33e9e48b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789401, "uuid": "d108138f-4f87-46a1-9722-fe921258a29f", "comment": "Malware payload (AveMariaRAT)", "value": "9e6563c2c5e8a869bfdbf4ff1336bf2abcd238695d87f79a01b308216acc9cb5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789401, "uuid": "0b28aabf-355b-4da1-8f5a-732248e4b2b3", "comment": "Malware payload (AveMariaRAT)", "value": "d126c0cf51a98d9f3bd38efa6e61d4091104c624", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789401, "uuid": "578cd299-8aef-47bb-bf6a-26f7840839a1", "comment": "Malware payload (AveMariaRAT)", "value": "39a398ead2c0bc309b2c1931d13a052ab3f9f6feacc7d8818b2a25ee848e31317ef7214a814f22db05d4918dfc15a09d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789401, "uuid": "3202dada-7c23-4982-8c25-56bf277b4ba8", "value": "T1F0B5CE1D25B5086BF97C1A30142547374EF26C3D947BE7CD3B88356B4AB2A840B267EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789401, "uuid": "3e990c85-6e5c-4ad3-810e-4e830ce9a866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789401, "uuid": "527c513d-234d-403c-9b60-c6ff8913ace0", "value": "49152:DeZkT1lcGocXfF7MGN3GBoqn8IEBYQpp2r7htbTUCdnLv:y6T1lcGpvjRGB77Up4n/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789401, "uuid": "b5d650c5-75ad-426c-b43d-92f3985297f6", "value": 2296320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789401, "uuid": "d3d91a8c-2c85-4ef6-a13b-7937d6f9b2ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789401, "uuid": "ff8da509-6ae7-4b20-a4ac-255d00a4370d", "value": "PREVIOUS CONVERSATION.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001d539d-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638773086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773086, "uuid": "048c8902-3af4-40e7-b60f-5069fe979cb7", "comment": "Malware payload", "value": "0c365ed58c184687298628549873891c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773086, "uuid": "406879fb-e478-4dcb-9956-508d14ca4cbd", "comment": "Malware payload", "value": "9fa640e9075b2906847f0a6dce603257b6c99d97b41324eeb298c2a202f95b35", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773086, "uuid": "5ce41042-6f02-4690-9e1b-4475ca91814e", "comment": "Malware payload", "value": "db8c4a33847fdb41868ba92c250b11c86a98d4d0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773086, "uuid": "f028f58f-3010-45b6-87c9-363bc4c3ea18", "comment": "Malware payload", "value": "cb2525fe5402181232714952d16475ecaacd4ef83c7762f9079e0cd142a3f0fdf909204097badfc93f6071a644952e54", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773086, "uuid": "b740bc9c-f3da-4bdc-b142-d3d86074e25a", "value": "T16404D9467ECEFD14DDE686BE0D858FBADD1E74EE446001F931C8B22A6831B605FC854A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773086, "uuid": "97bef873-f926-4e03-af23-393ba9a62a95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773086, "uuid": "fff5b800-97ae-4bee-aac8-cb6a6a321cd0", "value": "1536:5ObH91kKhhJsiSP3/euuuvuuuuuuuDnN0Z+:5ObH91kKJK/DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773086, "uuid": "02c46e4f-efcf-419d-bf53-dcbc73965b92", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773086, "uuid": "e80c37c6-db22-45f4-8335-8f808448dfb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773086, "uuid": "c56744fa-0031-48ca-9c8b-2ee43e6c308a", "value": "DHL SHIPPING_DOCUMENT_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fb811d-56b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638811661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811661, "uuid": "2fde4daf-a469-411e-abda-f179be3d06b5", "comment": "Malware payload (NanoCore)", "value": "ffd256ff0d8012ab56cc80a7f42d5691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811661, "uuid": "807cb717-5914-4c90-a094-0794a19d0543", "comment": "Malware payload (NanoCore)", "value": "a06e30827c6c8ca0154c68a7b960353ddcb1c984fa29c975450121624a518b17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811661, "uuid": "217dc8ce-35e0-4cd6-a379-551eec7f5f03", "comment": "Malware payload (NanoCore)", "value": "8940bff6795777aa2c8584f413e2c127e3645082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811661, "uuid": "fb8b7d4a-f73c-438b-9bff-7f6c8ccb7b45", "comment": "Malware payload (NanoCore)", "value": "5de12077681f30fe42c4a7488838ec1b73bf3bef5567d34ae8e7be256442ca31449a66baf637fb72e3a89c8def5835d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811661, "uuid": "fb34a86d-a4a7-48bf-a233-c1b9a250451d", "value": "T13E555A5C317025AFE83A853145540F779EF12C3E826B93CE7317346B9ABE9468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811661, "uuid": "b21e41e6-1d10-40e5-8c8a-43c204afc13d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811661, "uuid": "787bc601-b081-4d48-b800-64145f3789d3", "value": "24576:z9VawLXdeTikukLTlzM8WOVHW3JJQtJkuUp3eG/UuUG:zewLXUdTFM8zHJtJkjOGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811661, "uuid": "648c942a-6620-44f0-b258-552278173ed2", "value": 1377792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811661, "uuid": "a70da992-5413-485a-ad01-c76ffb27ea27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811661, "uuid": "140ea641-ee68-41d1-bb8f-8f5ab77061a9", "value": "ffd256ff0d8012ab56cc80a7f42d5691.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d949b7da-5671-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638780751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780751, "uuid": "fa2e95b0-92d1-4568-88d0-2e130a505048", "comment": "Malware payload (Mirai)", "value": "aa35557bc52fbd009966621c7ab701d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780751, "uuid": "ee07bffb-915e-450d-97d3-739714278bca", "comment": "Malware payload (Mirai)", "value": "a0ae4e5a0e2bb2d4390bde9a8354996c4a7f6312ef7acd4fe8cfe35b766892e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780751, "uuid": "c811e204-77de-4e5d-a76b-2714c9e434c2", "comment": "Malware payload (Mirai)", "value": "6bf649f6e1bde5f72ac4a9fe80d4924c83be4609", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780751, "uuid": "4d096c45-b59a-49ab-9c74-496ca9ea0c0c", "comment": "Malware payload (Mirai)", "value": "4bb5868a1a1c81bc512a81a223366822617e9f0f24590aa3be70c78868d45e4329e8fa088fe7b341238fb7f4b2cbf138", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780751, "uuid": "68cd5714-771d-4535-8002-ca6077d6cda4", "value": "T1C2A32943A9655F77C0866AB165EB5D300B23A8921F4F1A89713C9BF4474F8CEB40EFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780751, "uuid": "8b427b67-ab8b-42b3-9e57-43cc604ba196", "value": "1536:F31tyz/DBCKUmf/vEPUaJbUZC96RnvDQYhoaX7lK8CK:Zqz/DBlUqEPOZO6ZDQYhoaLlK8CK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638780751, "uuid": "c56f09fb-1759-4222-93d4-da43745ab60d", "value": 97992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638780751, "uuid": "b7848b54-dbcb-4642-af73-2b37df484b85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780751, "uuid": "61e0bd6d-4910-470f-9cd5-2d894341bc31", "value": "aa35557bc52fbd009966621c7ab701d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3785d0-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638773217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773217, "uuid": "425ed797-f298-47e2-82c1-faad58b78c8e", "comment": "Malware payload", "value": "e4f58e9337c72c2306072b6af996a79e", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773217, "uuid": "a27695f6-5ede-4506-b6c3-2a55003db7e5", "comment": "Malware payload", "value": "a0b17155cbe27046be19141af0dc4e4cb77037709b7f8b1e034f4f600396d025", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773217, "uuid": "029352f9-7899-43f3-950e-277806e33861", "comment": "Malware payload", "value": "2b2afb1b4be978ca9510f9bc0150673431a84078", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773217, "uuid": "427a2c90-c720-4731-985d-1405d0d36b95", "comment": "Malware payload", "value": "88ca245cbc9daeae9c76124c838d99c554d324b88bfcccba33b423c4b8f6d5454c8381d7adc7ee3647a4deb9517780ad", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773217, "uuid": "91d69758-bd71-40cb-b678-82d37a44fe67", "value": "T1E172B077B624BAE3D70BE0732CCE398F5B49D5A99CFAFC7BD419051F09594E25A24002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773217, "uuid": "aefbcb46-30b4-4a8d-be1f-e98b86e22a6a", "value": "384:bSPD3ajB097V1ZCDuwk8heq+1oquAEidVxs+CxE+rGOGn:OPzuB+51kc8hE+AJVxs5xlrFGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773217, "uuid": "fb4e7bd1-5c92-4d9f-b7b3-e87d1fdabc2f", "value": 16502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773217, "uuid": "04c609e2-8147-48fb-be4f-129d8e66f04d", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773217, "uuid": "6adf4483-39ca-4fbb-9100-ad906390b1b4", "value": "25.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0143a063-5697-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638796710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796710, "uuid": "025189fb-ae9a-4f77-8eae-083b99687ec0", "comment": "Malware payload (AgentTesla)", "value": "12f5435e648775512227bd194a2f3791", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796710, "uuid": "83981e2e-85a6-4264-8595-95987873d98a", "comment": "Malware payload (AgentTesla)", "value": "a0dd30e967f6e54362d05f31a9b364822f11a525db6faafdd62f76123176b42f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796710, "uuid": "1ccb6b0d-5e25-4c68-b933-8bf616c19678", "comment": "Malware payload (AgentTesla)", "value": "7c05a90cdeb98533d38e8c8666ab0d6992f22522", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796710, "uuid": "afc0d98f-5248-41fa-8349-885d902555df", "comment": "Malware payload (AgentTesla)", "value": "ff316ea7d3c9a7fbe00be4e3a2e2ebe8e7136b6955cea204c51ede9b3da3dec955e381c3bb9167b720fee0f4a908c2bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796710, "uuid": "222bae03-7a54-4583-88b4-ab25268bb7ce", "value": "T1EC657B5C317025AFE83A853145541F379EF12C7E966B53CE730734AB8ABE5828F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796710, "uuid": "246b09ef-447b-4260-8348-96f2981c77a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796710, "uuid": "09397d5b-6720-459d-95b9-19eb9339b36d", "value": "24576:VSplLigqONxaD/RpsTEdAdeshzSb2QslOyyQ8P9+RyCbjbDp:0lLi+oD/RpMEdA7g+c6bjb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796710, "uuid": "b4090eee-33da-4409-87c4-dbea41fc49c4", "value": 1432064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796710, "uuid": "3ff2fa8d-d3c4-4555-b7e6-e46c05a036cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796710, "uuid": "86d98e29-f2e7-4564-bce8-f618e3811621", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff8fd57-56cc-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638819739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819739, "uuid": "53aa70ba-6256-41ff-96be-eccdb027f73d", "comment": "Malware payload (AsyncRAT)", "value": "013938e31d3f6747938b46c8eed70de9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819739, "uuid": "10d8ad56-b383-4c03-95f0-4984194a7d5b", "comment": "Malware payload (AsyncRAT)", "value": "a180c78caec1b94004f0196bc8cc10171f266810428d9fb3a11cc91ec72125fe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819739, "uuid": "f17321cc-bb55-4952-a0c5-8d979715dae8", "comment": "Malware payload (AsyncRAT)", "value": "c08462d712a2b082859061570ada59a632e36733", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819739, "uuid": "bd4b117e-99e6-4590-9216-88359938bac2", "comment": "Malware payload (AsyncRAT)", "value": "ceb4fc7069485c986ba181896d34c80cbad06442e00c0835570be89ef2207590b5627b2060a4c38e397173acc4c6fc0a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819739, "uuid": "9935d2d3-3a06-4ce3-bce9-5310fea48782", "value": "T10274CF4535DAD6A8F83BE7B50CB175C503B8F1E0F981F2EEFD84249A98A27904F505B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819739, "uuid": "b73eefa5-a542-4a3b-83f9-b1d764368eaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819739, "uuid": "6b2716ac-b68c-4de0-b81c-fb69cb81eaef", "value": "6144:6CJMn/JNjmWFRSya2GhNQnWwbPPEC/0y/7eZMUttgzbDZeQKZSM3BSavf:6Bnva2iNQWwbPlXTeZMUtazbDhRgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638819739, "uuid": "f7cf31a6-66c2-4e06-98a9-a77c9ee78964", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638819739, "uuid": "300ac305-b9df-4caf-9796-241df68312f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819739, "uuid": "0f11d0fd-ca3c-4c9e-b31b-7f1e7429a303", "value": "RECEIPTRC24466265.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96db162a-56ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638832609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832609, "uuid": "96efc4dc-241f-49f5-a98c-e19e07db56e8", "comment": "Malware payload (DCRat)", "value": "a5ca466db19d26f3e1f60a5f0810635a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832609, "uuid": "c6694def-31b5-4945-8a51-11fc0f53a598", "comment": "Malware payload (DCRat)", "value": "a20ba9dd24a029f333421f3a74955ed7a107d6721e20d1c063bc2083fa2d3f7d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832609, "uuid": "fdec3533-078d-4227-81e5-cf8d3db3fd26", "comment": "Malware payload (DCRat)", "value": "326ce74dbcc84fb820876d6af8c0da1b77931b2b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638832609, "uuid": "e5e0e528-e42a-4e48-a4f0-d21a95ce89b2", "comment": "Malware payload (DCRat)", "value": "ef119f74d6445721988f33b6081a8d741abead9e4170870ca4e6402ab0263f67b9bd94599bef93359fc597be9754e5c3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832609, "uuid": "e4491fd0-337d-4016-b01b-3057ee7b63c5", "value": "T113B5CF113E84CA02E12A563BE9EF805447BCFD416E62D71A7EAF339D25513A71E0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832609, "uuid": "30b17141-a298-4a99-af38-519591784cb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832609, "uuid": "8c7cac14-ef61-46d0-bfd0-3c5da8431d00", "value": "24576:dg/TM3unSV8JHYj0M14oMKhqN8+r/tse9WPJXelRWjq+jPx8FT2t6nTtHtO3g4Jc:2QenScjKkr/y+qXeliq+iT2t60g7Er3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638832609, "uuid": "71471359-c691-4a4f-9b7b-fd5c9bd5e06a", "value": 2341376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638832609, "uuid": "f0a4c4d5-7613-4e4f-971f-ec03f5a24433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638832609, "uuid": "00e9fa4f-935a-4aa4-b2df-170c5a1b852e", "value": "a5ca466db19d26f3e1f60a5f0810635a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3442e4aa-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638773173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773173, "uuid": "c30dcb88-23b5-4b5f-ad40-d99e207c49ab", "comment": "Malware payload", "value": "6b0be314ac6fc3c8c5ca31966068d7ae", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773173, "uuid": "24406f05-1930-469d-bdff-6c4c70133967", "comment": "Malware payload", "value": "a248465aff37bdb0949dfe7ea7d785f7a29b29b523f1f7cf3501bdd9ff3c206a", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773173, "uuid": "71c655bf-c2e0-4839-ab75-c4571d4f27b3", "comment": "Malware payload", "value": "09ede110be4ecd7973c4a8c542d68502402bb966", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773173, "uuid": "cef38bc3-61a0-4091-924a-f48fff8e56e4", "comment": "Malware payload", "value": "94ca00029b8edb23e66d8e9e6741bb5367f30b5850df3476ae40ca46d869337d8921811f99b54ee5a2e2089d30001dfb", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773173, "uuid": "02a05d80-dc35-4847-8d2f-e4ca94d32b72", "value": "T18D72CFA6EC18FACAC607DD7405390EEF7E26E490CCD7B9C5B400915D6C9E6132A1F35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773173, "uuid": "f475bc67-5919-46bd-a38a-934736006524", "value": "384:9SPnN3EA5LgnmBeA4VPL7MNOT0jJn6/89TktLUVPJlA:IPN3EABQOeAqPHJ0jJvqLUhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773173, "uuid": "5edf98a6-8dc7-4488-87d9-654cbeb4a7f4", "value": 16282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773173, "uuid": "c7e7f5b2-fd47-4711-a414-8c812c8059ce", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773173, "uuid": "677fce55-5b09-4cc7-99be-8104a9b8affb", "value": "IRQ2107798.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f84980-56cb-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638819345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819345, "uuid": "32c7f06f-f72d-4a71-944b-ddde381e0b7e", "comment": "Malware payload", "value": "5c1fe6d1ccf619b1a49d409e32483c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819345, "uuid": "e6a56ec8-89c0-4da0-a7b1-08c176a66518", "comment": "Malware payload", "value": "a2dfccc1354156ecd13401ac0e69393412007ae42ba1340bb1385e289be64a0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819345, "uuid": "c4dcea82-9613-462e-bd6c-8e44f6a2798b", "comment": "Malware payload", "value": "afba0b790007426c58bdd92efad22230f58bcdf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819345, "uuid": "9aa22880-9357-4b43-b7d2-a21dd12346af", "comment": "Malware payload", "value": "1e8ce1d1fc7d792b0bb11b99d9bbc106b8e2a815ec1f09d9970977467f61ba7e4ae411444a709085b0c733b367484999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819345, "uuid": "419548d5-fdde-4d57-9ecb-c00da6f18067", "value": "T109E3396562D0E6D5E1A6B7B1EE66F26C51867C3B388504CF8DC236AC2B31B4392D3317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819345, "uuid": "8d8ad03f-b9b5-473a-b257-22a580fac587", "value": "460340e2ce791b610d6d419830ceb88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819345, "uuid": "10df306b-4b45-4b90-a805-8430b8c718d9", "value": "1536:o4sxiC2W1lLCELYYb7m3lD4TDER1a457qZKrQiDv5MA1:oOc1IU7vMD4iaMKK55l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638819345, "uuid": "83f1035a-f854-4fe1-9770-49bbf9a75223", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638819345, "uuid": "940c5014-6d0d-4c52-bf6c-7a7aaf12dc96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819345, "uuid": "0e0c3b41-b9ef-42dd-8128-296aa30fe5af", "value": "Payment_Slip_USD11,000$.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469ae960-5663-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638774492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774492, "uuid": "ffeca1d5-8855-4280-a935-03dddaac3913", "comment": "Malware payload (Formbook)", "value": "29dc1eac8eedc9e93fe27a0334e095e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774492, "uuid": "40d222d5-0022-446d-80c3-50a1f647fe62", "comment": "Malware payload (Formbook)", "value": "a3209bf6cfd9b6286923251b6d5da80997c6b3a51ec3bfb922388ee5e8944ec4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774492, "uuid": "17fc16cb-6d13-4a60-9c8f-2b38d19cf4c6", "comment": "Malware payload (Formbook)", "value": "b63fc8b9a18481cafff303424c03f245a150d576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774492, "uuid": "f175d13d-f334-4bdc-b8d1-3f849f3d4a7f", "comment": "Malware payload (Formbook)", "value": "1d6dba615402db0a496bc997f81d7ae46026bb18ed1085a41567199657068fb7b1988deb0d9d34d4ce624c6539fe5c80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774492, "uuid": "4500a8a0-0200-4ead-abb4-3bc4cbbe0c72", "value": "T16D456A1C21B5086BE97D1A750421577B4EF26C3D99BBE3CD3B48316B4BB26840B253EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774492, "uuid": "d38a5ca9-33ab-46c9-9f11-440dc0a79b7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774492, "uuid": "bab427d0-ea55-4fb7-b517-d6bd1b9aca12", "value": "24576:uv8RZesuiNUX7lOpqY1Of6NnVZ1AvgudpCApLo:YD7opqDfKL1Ao0CApLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638774492, "uuid": "11c69fe7-533a-4c47-9dc5-5260fa8b03b2", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638774492, "uuid": "4b561e31-b358-4705-95d0-494acc608316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774492, "uuid": "684d9f72-e3f3-43e2-804a-725b95077a22", "value": "29dc1eac8eedc9e93fe27a0334e095e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce437fb-56b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638811440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811440, "uuid": "cac16415-5561-42a4-bb4b-882e97a779df", "comment": "Malware payload (Dridex)", "value": "8dde09c78579caeb7c420b4dcd2be8da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811440, "uuid": "be11b59e-ea9c-4558-8a9d-442ff5586e77", "comment": "Malware payload (Dridex)", "value": "a3dfa1523b6029b94ec05e06b7cdfc4af47ebf0e3bbd58cf141a4a5fc31f1724", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811440, "uuid": "47264c51-6969-464d-9b5b-7b7b123eb634", "comment": "Malware payload (Dridex)", "value": "5fe60d57237548f62e3313d03e5e056184204ed5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811440, "uuid": "61ebd00b-c0aa-4035-9781-971ee82517db", "comment": "Malware payload (Dridex)", "value": "649b1e33c2f82b0ddbb42f156a1e90d5a3aed0777f5cddd38dfc93f25b0737f6eb19a1e6d1296dea4bda75700724657e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811440, "uuid": "af7895ef-ad91-45a7-9c90-d1ab4b315610", "value": "T1609302189157D884D2FBA87D5A0585F4E805ED20863073CFD5DEBC2AD6F08FBA771928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811440, "uuid": "3aa93f1b-a83d-4dec-9711-03d5552c18f0", "value": "1536:RvrjYDRh+0dsY9bduAMW/PpKiYp+mZf3sbZYPTQk+X7+RUuYdbY4qpqdIs:trstM+Z9cAlpy3f3sdMT/+XCR684qpqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811440, "uuid": "102e4f28-10ee-44fc-9ba9-7044873f528e", "value": 90567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811440, "uuid": "551e2449-34c8-4caa-aee0-97f5f2315478", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811440, "uuid": "59089a4c-941f-4558-9a9b-e6cff9aae81b", "value": "act corrections12-2021-252405.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2018077e-564e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638765408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765408, "uuid": "e35f12b0-aad1-4be0-97b2-bc5d76f95898", "comment": "Malware payload (AgentTesla)", "value": "8afd982693c93a9802b4f7a9576520bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765408, "uuid": "f8ee9f87-405e-4d88-ae06-71b18afd126b", "comment": "Malware payload (AgentTesla)", "value": "a41c3584941f1e62e97a9c8d8db2146f74fca49939b2dc84828548c14331ab2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765408, "uuid": "3a9334ee-1faa-49b2-b524-617129e29084", "comment": "Malware payload (AgentTesla)", "value": "c430474b57d48402edc1d5fa4d64b473f45c5ae4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765408, "uuid": "b88119e0-ff06-4a0f-964a-7dd8803e2b57", "comment": "Malware payload (AgentTesla)", "value": "819a9f916b19ab12687b0cf8a4a95d51d45352d6ad8a4909a30fe2e239859399bdc24c0b1f92bfc4e5055844d167d41b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765408, "uuid": "9cb8455a-e68e-43cf-94b0-fa73d745687b", "value": "T16A35AE7EF96E6F00D1A80239C0F5B47091F5AC62A211DA7FECC439DD0BA17AC156A8D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765408, "uuid": "799d18cf-1568-4d85-b5ab-48610cf47037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765408, "uuid": "95d589ba-faca-4f3a-9760-f9cb6af53de3", "value": "12288:9YpzkRPZZXlOnlIrH1lAgM8PFLEZEXj8TOHziZ+EBYu3mS3gFLpR0xSu:9plO0+gRBEZEokmZNBYu2S3kP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765408, "uuid": "dcc5fadd-cc66-45a6-a355-5bad71af934a", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765408, "uuid": "7ce60aae-736c-4c3f-95c4-7f3573c89b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765408, "uuid": "5b29dc72-966c-475e-9de7-92d1eaf62e83", "value": "new order 00041221 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edfbe47-5679-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638783982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783982, "uuid": "d537c35e-864e-4dc2-895d-0b3f2ca69171", "comment": "Malware payload (AgentTesla)", "value": "2f3320bc8ae5280a5f9accef9bc71c57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783982, "uuid": "b6f9f6bb-6ffc-4ea5-9b9a-e8de6ba4c202", "comment": "Malware payload (AgentTesla)", "value": "a461c863d3271addb5183c4a8f1e9ebeccd3c487b613822494f5b8edfc593465", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783982, "uuid": "1d730761-c053-4546-a1a7-bc32677c1b73", "comment": "Malware payload (AgentTesla)", "value": "d60f782759f4349b654cd5f8858185f86e648456", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783982, "uuid": "c4b00893-e194-4510-bbea-0a31c1d19f3f", "comment": "Malware payload (AgentTesla)", "value": "0c78d3d9199cba2af91c95030aeb8c0f253aefd46a5ad12bf81e9d88c254e9881b9fc3fd69d0f2b557e5899444d0c3bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783982, "uuid": "9200ea08-c5e0-49e7-94c3-e467eda8705f", "value": "T147656B5C317024AFE83E853145540F779EF11C7D926B93CE720734AB9ABE9828F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783982, "uuid": "aeaaf320-98d6-488c-b2e1-d11e3d9c3510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783982, "uuid": "7bcc50ad-4221-49c0-9f1a-96dbf34e523d", "value": "24576:J76WeILcO6oXBnVI7LYvyMZG4tLIVUp8qP2/E8PjD0uJ6Ix:JHLcOFBnkMbZGQIh/ECouH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638783982, "uuid": "d60a5adb-720e-4d74-857a-73dca17cb8e5", "value": 1430016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638783982, "uuid": "4e9dc442-0a3e-4981-8306-031674007132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783982, "uuid": "5ef4f7ec-d741-4d71-961b-ce4cea84ad9d", "value": "0106012021Inquirysoloo,xlx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b2f6b4-56dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638827003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827003, "uuid": "2467cd91-b5b9-4211-b656-811198b4a4ca", "comment": "Malware payload (Mirai)", "value": "84dea7f61bd41deacc9dd1821b65572e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827003, "uuid": "cd719f5d-d066-405b-9959-682ef4a7b919", "comment": "Malware payload (Mirai)", "value": "a4b4fee6eae81b8b86327481e3fdc77e2d0e43e3530149ef24872175a2802e53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827003, "uuid": "fef8bf8e-eb1b-48d8-afc6-f488f5a451f4", "comment": "Malware payload (Mirai)", "value": "5594bda684d4928896453398769f830aa157d516", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638827003, "uuid": "5aaa95fd-60ad-4d26-bcbf-c7d3fd5901c9", "comment": "Malware payload (Mirai)", "value": "9982de2fdf15e91101ce1866d8fdecc56130ba6f84cbb9154e4cdfeb82a7e3b35f94c31b99f46ce0603aed25f201103d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827003, "uuid": "4cccffc5-7669-447c-876f-14c2713b3e63", "value": "T1FEE2E15C3B50519AD9B7C0F52AE40BE02D6604F2AD06CE4675AEDB471C8B23D2D03BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827003, "uuid": "5bb4a7a6-7a7d-4c6d-bef1-86c9aa5ed2e8", "value": "768:tgc55Pi1V7eSQC9wbczmmqs/QYDXhmJgGlzDpbuR1Jbt:tgc3kNeAwomRshXsVJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638827003, "uuid": "8944bd3c-053c-4edf-8f81-e058fbf77cda", "value": 33372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638827003, "uuid": "797d0318-2e1f-48c9-ad32-250fbd3f2c83", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638827003, "uuid": "f3c32f1b-8020-422f-a21f-ce7527663dd8", "value": "84dea7f61bd41deacc9dd1821b65572e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b1175f-56a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803634, "uuid": "1dbaf3f7-88c4-4014-a1f8-3bf86a280df2", "comment": "Malware payload (Dridex)", "value": "2717328252b435c2f577439ccb103442", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803634, "uuid": "b7553035-50a4-4ade-88be-3e88bd6c0db5", "comment": "Malware payload (Dridex)", "value": "a59b13fc30798d05075a80a378259eff494dff34e99c2d1f391a811b3aa93f01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803634, "uuid": "98994404-f464-4d80-8905-063751d9c857", "comment": "Malware payload (Dridex)", "value": "0bf6dee4bc4956420fdfb953a271acefb5df9d8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803634, "uuid": "f90249b7-8594-4c32-9069-fc09a584a426", "comment": "Malware payload (Dridex)", "value": "322b7cda86899088aa4e1df5fadbd1f697800bfbe928af8159646c00b34805f45e321a8eee03bf5f1786f56b8009f67f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803634, "uuid": "9cacaae0-26fb-48ff-b9f5-67d2fc446097", "value": "T1CCA4BF4FEEF690B5FA32F8B174528292E1CB9C752002B7D485616A58FCE4C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803634, "uuid": "c61d892e-59f3-4460-8257-c06d0cebcf48", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803634, "uuid": "69675a30-632b-41c1-a0d9-ea951869bd0f", "value": "12288:LCfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWRF:LCfzehtApz4lzQvzU3H2Jz+BbAt3A1NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803634, "uuid": "e496b3a0-c3d0-418f-a50f-534fdeb98944", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803634, "uuid": "14ceaad9-b6b9-4c76-b2cc-5fc2ee96f7ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803634, "uuid": "9f1de078-a6f6-40a3-908c-783200a2ec56", "value": "2717328252b435c2f577439ccb103442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480dfc6c-5694-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638795540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795540, "uuid": "cae1adf6-671f-450b-b30f-97612cd6c7f1", "comment": "Malware payload", "value": "418d67bdccc7c74875e0bc6c222a556e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795540, "uuid": "82cd7994-9fe6-4e14-8705-34ceb861737e", "comment": "Malware payload", "value": "a5a8bd220d25a52cb97b7aaeffca5ab4c8d47f5d53302411f10348f0fa1a6aa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795540, "uuid": "70c3f963-68e1-49b4-b749-08e79d6d2e6b", "comment": "Malware payload", "value": "7f24f43e0de601467c5dcc6b654623dbe8151e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795540, "uuid": "89e33cd1-c013-4783-be88-a9700c764c97", "comment": "Malware payload", "value": "aa1e9dc50fba2e34da4eda48b59032041583424aa4bee615697aa1b9a833c5026a75b946baf1c9f0749a5b7d0c264bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795540, "uuid": "e5efc29b-f875-484f-8a5d-21fa1f44f7f0", "value": "T157457C2DA7F1BD2EC2A61A37C01AC45546E19B441763E36AFABF06932E4F3B40D5E1C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795540, "uuid": "687256b0-9fd6-46e3-a455-e254f5c880ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795540, "uuid": "e6e9e956-08fd-43b5-b21c-6e6271c0fc83", "value": "24576:svwDzmEgVTKYTx83lFXvVd1emdO2DDAQ/4/Ksn:vPmnpRTu3HXNd3dO2tTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795540, "uuid": "92cbdded-f78b-450c-8a95-7b27e7fc4e38", "value": 1271528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795540, "uuid": "f080a37f-eddc-49c5-8d1c-bc2f79266fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795540, "uuid": "27618478-a1bc-4e7f-9525-1844ae921334", "value": "418d67bdccc7c74875e0bc6c222a556e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8483fa14-56dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638826995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826995, "uuid": "93ef1f7c-447b-46ed-bafe-1b5e1bf79536", "comment": "Malware payload (Mirai)", "value": "29396733c840fe6d1333b1aa90d6df92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826995, "uuid": "320391e1-f1f8-4120-82dc-ecebc57d2f94", "comment": "Malware payload (Mirai)", "value": "a5b70b1d49c75ca27bb47852dcbdff95e7eea83038e95bf810ac756f51152331", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826995, "uuid": "16c40f6f-46ab-400d-be6f-fcf1d40ec0d0", "comment": "Malware payload (Mirai)", "value": "62e3d9daf338ddd0f15d9d003fe8e158e30509e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826995, "uuid": "2da0d142-f988-45cf-afbb-8410a394deed", "comment": "Malware payload (Mirai)", "value": "904c41a794c5196bd220088ed264a08c34b82f0ce0ddeb51da0a295c30c1986549214efdd37314393d75bb2d7ab6493e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826995, "uuid": "b0f963db-34fd-41db-85df-3e1cd313bcf9", "value": "T13D53BFA2C9542D28DA154A747810CA749333F42487872FFAE555C37CD0279EEF1AA3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826995, "uuid": "ca2652da-654e-4b9c-bc85-2b71b0b712ef", "value": "1536:5aE242P22AINT5xAB7diyydq5QKl7hhc5fUCHpmyyu:5T242P22bT5xA3Tj53lw5fUZtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638826995, "uuid": "92467264-97e8-452f-a8c6-10f1ef9d417e", "value": 64312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638826995, "uuid": "41a1cef0-b156-492f-8022-e6c089d2f17c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826995, "uuid": "cdb4025a-3312-438f-87ff-8391ae9ebc0c", "value": "29396733c840fe6d1333b1aa90d6df92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16af0d76-5684-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638788585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788585, "uuid": "d79383f2-f2b7-4caf-a20c-ba225b43da77", "comment": "Malware payload (Formbook)", "value": "85b9a2956290e95642c02238cccd5139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788585, "uuid": "dc0c0b6f-3a83-4b75-aed8-72b10e7a6758", "comment": "Malware payload (Formbook)", "value": "a64d34bf138099a5db64f2fd397cc609492873c2c5e6fd7e06656750721913db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788585, "uuid": "768dfb18-b610-416d-969d-f95625c023aa", "comment": "Malware payload (Formbook)", "value": "faa04f350ec11a40f0a504a4e387756d4fd581de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638788585, "uuid": "45819259-e0f0-4211-80b0-0de8ca856d1c", "comment": "Malware payload (Formbook)", "value": "6f37524265ed4db75b41a48ac835552a714d370bffdb5f280d0c36f6c01bce59ed54ec610244a4b8e67042e53615cd1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788585, "uuid": "a4224090-dab6-4407-99b1-4c5ff8007592", "value": "T14164120FAACDA87BD1B205314262D3B4EAFA80955372C94F4F9C7F3FAB614474B89614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788585, "uuid": "a9a71476-c979-4843-a5e5-bde484860d41", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788585, "uuid": "ea716788-8937-46b4-a196-70358569aedf", "value": "6144:rGivgBJYSMPIocvGqLnhO8TSdL6BOP5uXBi4nlAfiE3DhZXigiS:zgBJY1PIoc+Mnh6GOP5KBiUGi0hZDiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638788585, "uuid": "b8094603-351c-4f57-9116-ffa9539fdf16", "value": 319312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638788585, "uuid": "9adaaf28-2813-4a6b-86c9-3088869acdef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638788585, "uuid": "73301517-4370-47e1-8269-5dba9a980281", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7240adb4-5654-11ec-96a4-42010a9c0029", "comment": "Malware payload (Adware.Generic)", "timestamp": 1638768123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638768123, "uuid": "98e89ed5-56d7-4585-9a6f-53008ac2d7b1", "comment": "Malware payload (Adware.Generic)", "value": "3782aab45509ce19402fe46143f636c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638768123, "uuid": "5970fd21-ad53-409f-ad25-9a29224e1cef", "comment": "Malware payload (Adware.Generic)", "value": "a6735516af8ff6950ff3651319aaa9d3f95703e5a2283864e85986d4076dab5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638768123, "uuid": "636edfe1-3d36-4c48-8b6a-9625b0faeed9", "comment": "Malware payload (Adware.Generic)", "value": "7fac23256f917b36a160263b682a5022aed66b52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638768123, "uuid": "d011aec2-451b-4bef-a3ab-2986e97742c1", "comment": "Malware payload (Adware.Generic)", "value": "afaac9d1964e863381293d14b65a44d54767838b77d77ae6f31d045c434c38bc4ee537a350958d836eae2b435f8f4596", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638768123, "uuid": "fb552a69-4eb7-43f4-b32e-87e04607239c", "value": "T1680502113640C032E7690730959AFAE48AA9BD7815E4E54FF63C7E396D712836A3B1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638768123, "uuid": "c8474102-0267-4510-a085-da09e29e2bd5", "value": "71fbe3c598de29fddab33a914b98b82a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638768123, "uuid": "7b195a86-1d4e-4d07-8fe8-24647276d968", "value": "24576:2WYJJKNaqT2HtfW3KuokXA+6fXdN3hUl/pZXy:2WYJkTYHUh6fXH3hUl/ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638768123, "uuid": "d7ca5287-0449-400d-8f6c-f814c079edaa", "value": 857880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638768123, "uuid": "5d61fb59-1c75-4868-b872-1d273121bbfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638768123, "uuid": "cb88f657-635d-4525-b971-3be2c9cd9008", "value": "3782aab45509ce19402fe46143f636c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6299b920-56a8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638804175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804175, "uuid": "33ace2fd-48a5-4bfe-9ada-1a36152f75d3", "comment": "Malware payload (Smoke Loader)", "value": "10f7e0838daf043d95f781b58338dc0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804175, "uuid": "b8e1d31e-7c2c-4e27-819a-4df66e0429b8", "comment": "Malware payload (Smoke Loader)", "value": "a6c7307586add646c353e553da6fb9a19a11ef07ada1861f8b96301cd902c81e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804175, "uuid": "8c55dc56-1b8d-470f-946a-70674be01725", "comment": "Malware payload (Smoke Loader)", "value": "cb3b217391428e5425b8d657f634d14dd9c27d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638804175, "uuid": "b8033c27-ad91-441f-b973-f389b71749db", "comment": "Malware payload (Smoke Loader)", "value": "e49f4edbf0c10ffaba7939f6d84404fa05b0c11f17fe84c3237a6a8e6838b7f6b4a14f17b2f5866278fc3ae7ee624773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804175, "uuid": "5fac820a-7314-48e6-a5cb-85cd590125ff", "value": "T149D4F11232C1C036C0F625768526D6F64EBB783906665A8F7FC85BB95F783D0AB2530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804175, "uuid": "a4c108ff-27e7-4507-a5b9-49b90a0a1d73", "value": "56620115eb6e0830bdf5b4ae97062a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804175, "uuid": "3f121212-efb3-4764-ac10-9a4d49e49d6d", "value": "12288:kp7BlG4xOHV+2u0lUzFaIxc+uaWnlPKedZI8jXWZRtl:ibG4xOsBzFaIxJWnlyedvezl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638804175, "uuid": "551e2ac3-80d0-4425-96bf-093d4448c92e", "value": 602149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638804175, "uuid": "82331141-c75b-4113-993e-a11e0d50e088", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638804175, "uuid": "293fe78d-3395-4b34-92b2-af0ed5947d01", "value": "11449.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4cec6a-5677-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638783010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783010, "uuid": "59900615-2a79-4ff4-b3da-3f20677df46a", "comment": "Malware payload (AgentTesla)", "value": "d914054a375c07b09e379eb8fc47a085", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783010, "uuid": "6dec57e3-ced7-4981-8e65-e71e7d83d1f1", "comment": "Malware payload (AgentTesla)", "value": "a7198ecd851f8420d4826282c3ea472e31840917a2b06f7659b66a8a97645c0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783010, "uuid": "c54cf09f-e9ca-4cfc-ab29-dc7125ee99e8", "comment": "Malware payload (AgentTesla)", "value": "f95eafd159c0a42099d24f5c6953e3866a84f01b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783010, "uuid": "a8ee7276-cb25-4e21-9a33-af54043e569f", "comment": "Malware payload (AgentTesla)", "value": "df5fa85bd327b5f8e7d93c53a6bad856e1463ec8b8dfec67cfaf2aaa5b43d8dd088c6232c0b62817c5d3e973549f300f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783010, "uuid": "667786b1-8bb4-4088-85ac-9bfb6f427257", "value": "T12B556B5C317025AFE83A853145541F7B9EF12C7D826B93CE7317306B9ABE5828F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783010, "uuid": "f65a0502-1461-4e82-8f2e-e985960ab6d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783010, "uuid": "a9de4199-cc6b-4ccd-8db8-0c358d203a93", "value": "24576:NwL1zQPAAR6OLuEez8Dnqb+dZDVC99yWBbhnlMR439:NwL1SAAxihb+dZo99yHR4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638783010, "uuid": "e25667fc-91d8-40b7-bc91-43ec3be9fbf4", "value": 1364992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638783010, "uuid": "5ad457bb-c91d-4d0d-bd92-3fb8260e432b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783010, "uuid": "abc75ac9-efa8-4c43-9534-208f01196830", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd79028-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638802506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802506, "uuid": "b1bdb7d5-9928-4791-8bb7-7857bd84a073", "comment": "Malware payload (Vjw0rm)", "value": "c53604f66eb2b9c34249d0596954ff72", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802506, "uuid": "e72b2d20-ca44-496b-80a1-bec38fa67883", "comment": "Malware payload (Vjw0rm)", "value": "a83a0eedfbf72c7be9ffa9c6463dcd2894c9a8a58e1ad159c3c53e0c5320f4d5", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802506, "uuid": "fd81bde5-aeb1-4228-bf3e-4eed61495764", "comment": "Malware payload (Vjw0rm)", "value": "83fd38d7b8d8f5275c12b35d259f6f069bcadbb6", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802506, "uuid": "3a094fc6-db03-4b61-8ff2-add106821a71", "comment": "Malware payload (Vjw0rm)", "value": "41bb8112e10be62c8f08c9155d3f5d495d5f2caf59d51fd072d663c36da5f3990b9f193ea99f2755d43e07f9f1bd4c3f", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802506, "uuid": "ae9327a6-39ab-4f74-ae41-38cc505bef8e", "value": "T154837C996F84B858DB90517804BEBE0C2BFBD142E8B0D01F356E7284EB53588E22F35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802506, "uuid": "93db2f5f-fb3a-46e0-a967-cc8074a1c369", "value": "768:qxpX51ZOgYxG95kbfHxb7vr3t+8lfWBsNSV2oYFCwT:ohTF95wZb7vjt3lfWBsNSVzYFC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802506, "uuid": "d9c91b10-f481-4b8f-92b7-4c30af766e82", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802506, "uuid": "7d5f7f67-9adb-4c18-baa2-12fb5810c681", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802506, "uuid": "9ea336e1-4aca-4ac5-8b42-32156b6bfdff", "value": "PG4636.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76574842-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638765123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765123, "uuid": "e28bbc43-26d9-4e45-b569-686e07b0391c", "comment": "Malware payload (IcedID)", "value": "89f72549d10ca37bda16dfb88b06163c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765123, "uuid": "ff9c8b4f-d2c0-491e-bcc1-8292e17c2f17", "comment": "Malware payload (IcedID)", "value": "a87650819ff9fdaa524de78d2024505b3afba6412084f5a18d001605bad4e52f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765123, "uuid": "68ec57f3-063c-4297-a6c1-f08c93655fa6", "comment": "Malware payload (IcedID)", "value": "6bf7fdcf959387f311a4d519c99addd83fcddbb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765123, "uuid": "0b25c665-4b20-4eca-b97a-0ab4c3abd8fb", "comment": "Malware payload (IcedID)", "value": "797fe18711d1fc9fdcaf736aa591548cdb3266a5482d3c18f3e79bb889b8c67949553c5c6cd3bc1ba7de9856b5adf3f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765123, "uuid": "2df50391-3e34-40e9-a04b-3b3364d2cde7", "value": "T183545B196198AEFAECFB94354BFEB29B9163342502B4CA965FA1095C4F4F1203CD3727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765123, "uuid": "8451eb36-2903-430b-ac6b-0690cc8df5a1", "value": "975e735f2bcd690b52fe54ae77c63faf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765123, "uuid": "0174d9cb-2fcf-4ab1-8238-bbcb12aa392b", "value": "6144:W5PE0TlM3HoeTzoDehOKi2y7mmtNQphgSoug1pLbsS+R:WhE0C3DU/rmYX1uNdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765123, "uuid": "c6da4e9c-2e95-40e6-98e0-46729d2a1c39", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765123, "uuid": "28e48f3f-09fa-40b0-b744-67227dd678f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765123, "uuid": "99dd2a06-20af-4305-8408-9c75ad7d3297", "value": "SecuriteInfo.com.Win64.BotX-genTrj.13538.31535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fd851d-5647-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638762672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762672, "uuid": "53c5af63-572e-405f-a896-91aa440df11d", "comment": "Malware payload (RedLineStealer)", "value": "1b0e14517c64f2d78b95b8c84686b77d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762672, "uuid": "cfba620a-29d1-4fdc-bbe8-b47dfc77a2b7", "comment": "Malware payload (RedLineStealer)", "value": "a8db037465927f9786056a97c54c7cb1534fbb2b04e6c848a865c40c52d45c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762672, "uuid": "f182e256-b319-41a7-a982-964c375f1d06", "comment": "Malware payload (RedLineStealer)", "value": "a8d0f48f5d739c16d73ff931eeb8dd776dbf026c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762672, "uuid": "4dfa2099-ffb2-4b6a-a013-e5e7af548685", "comment": "Malware payload (RedLineStealer)", "value": "4150423498556fc59dc92059da75fe522ae0deb37b7a7462f2965da14416eebaa11c26e93bb3b869828c9b1c4631a341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762672, "uuid": "9769405a-db59-4ba2-9e97-0a743a1f79da", "value": "T1F594BE10F7A0D034F5F712F88AB69369A92E7EA16B3460CF52C556EA57386E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762672, "uuid": "a12ed8bd-4f73-4551-8ccf-dba8cd33c68e", "value": "5da563873972430c247e0379344310f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762672, "uuid": "f34b70e4-fe9c-4ef3-a84e-3bf03c94142d", "value": "6144:fw1oMqN7hx7vuDbTjvh+++VvLiygIT++PtJO8EnHyzOLbVD2gu/vMS:fbMqNT72Tj3cOygIhPtJO8EnHy+VD2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638762672, "uuid": "4f53c850-6cb4-4cbb-b6c0-0adebfa9e2f8", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638762672, "uuid": "76ae344e-3b6f-498f-9f8e-5c047104a99b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762672, "uuid": "16e2a2c7-5b48-4ff9-9569-3f248c63673b", "value": "1b0e14517c64f2d78b95b8c84686b77d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa5aeb1-56d4-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638823032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823032, "uuid": "d087b98b-5264-4bb3-86f7-fa5ac887aeae", "comment": "Malware payload (RedLineStealer)", "value": "f35a27b6d01f53496e014972c261f7fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823032, "uuid": "f06b6f62-5dbf-4d98-af4e-46dab7fe580c", "comment": "Malware payload (RedLineStealer)", "value": "a9dc8bc2e80847e41c306c393801632e02efcd1a516cea1104912c4ccaefa8a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823032, "uuid": "dbecded9-bca5-446a-b968-9c3427b99d19", "comment": "Malware payload (RedLineStealer)", "value": "3d13d58434d9e57a1fd6d012247a95d96294f2ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823032, "uuid": "84cffe32-203b-4ae1-9a55-aea175ea2416", "comment": "Malware payload (RedLineStealer)", "value": "b98754f753c857ab1a13c57235c7ac3e738d0a1c28b77eb6eae0d74dc97ec6f44fc808cc3c205b309bab5b1e29a4fc6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823032, "uuid": "e6c28c66-7b98-4ebb-8816-5122621aa0f1", "value": "T14B84DF0532C0C072D19765718D21DBB48EAAB47109669A8BBFC95BFD1F347D2EB2930E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823032, "uuid": "8cc1432f-0987-433c-9595-68542d8d8ebe", "value": "d661587f40953a8f9407bb1324edc945", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823032, "uuid": "e8329618-68f4-4ec0-8ba7-c380f4a94f9c", "value": "6144:lrr/ikcrwVlDOPCcFun8DNGXreR5v1f/NkCcekyGmT:lr2k1V+Cyuq/NJcj/mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638823032, "uuid": "b245e6a0-7469-4dd9-b020-f7fc3ffbd5d9", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638823032, "uuid": "a30afe67-8226-40f6-aef0-3ac0252eb245", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823032, "uuid": "392c1768-0b98-4c67-94de-021f7000dc10", "value": "a9dc8bc2e80847e41c306c393801632e02efcd1a516ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123878b6-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778270, "uuid": "db84f507-c54d-4577-b748-6144a2a33d5c", "comment": "Malware payload (Mirai)", "value": "1fe2ca7c22833e9ad49ff5c6269eb260", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778270, "uuid": "b93c1905-31fe-4848-8864-894eb9d50f0d", "comment": "Malware payload (Mirai)", "value": "aa7b42c9bec63e77e8a8ee2357420d81d756749585604da0c606cfa389b48cde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778270, "uuid": "e9a08f2e-18a7-4e9b-bfeb-53db323bb3a7", "comment": "Malware payload (Mirai)", "value": "93f79a262baf35832c428a42b7d36fce550d51c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778270, "uuid": "bb8df232-2a7e-4d50-8d45-ce8643a8c6a5", "comment": "Malware payload (Mirai)", "value": "64e938b13d2d8058a87964ed07b46735c7e157e959d5587b4faf9f720f0b0fc4af01a7244520929e0537884864307b1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778270, "uuid": "f5b89cdb-fe18-4517-b275-6af5540a221d", "value": "T1C803E125B2E985CAC59B0D790D9EB545306CE11BC060E0E2BACC7A27DB5CF61F624FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778270, "uuid": "b7b9ff81-5259-4939-8a89-2939a7b0a2ae", "value": "768:gnWYEt8B4b2RXzRmiN+sAbFqd3nbcuyD7UyQRj1wsg9Y:gWY2I4y1z+lsd3nouy8yy5k9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778270, "uuid": "797b1cbd-4eb8-4fa4-83c4-0b3b3c920e50", "value": 38164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778270, "uuid": "5613f117-4f83-4093-8dad-f12a10e7c002", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778270, "uuid": "160bfa93-2355-4aaf-9fd1-9cff55af68da", "value": "1fe2ca7c22833e9ad49ff5c6269eb260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb42f63-5668-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638776655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776655, "uuid": "511d5a12-e2bd-44a8-89c9-260dac66be04", "comment": "Malware payload", "value": "1353993a93a17cb80e8e07b9adf7389d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776655, "uuid": "9a645739-31e1-4f60-91be-f3c9c26130ec", "comment": "Malware payload", "value": "aac0981b64fba0cee84f603a980236e3e381df03118d48343524a820d38e9c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776655, "uuid": "69acebda-5ee9-42f9-827b-30e1f5aba3ec", "comment": "Malware payload", "value": "30ca3090db8316f9a16b5e33f969d32be865ee9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776655, "uuid": "3a62bf7f-2a87-44c2-ae91-9db2451d7950", "comment": "Malware payload", "value": "127881b79583269210da136ea7315a5a318cc0f68dee93f287fe0e44d2f1c959c59debfe41a79324257393f403736389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776655, "uuid": "c6f26637-fabf-4bc9-ab16-bbb92e1fd194", "value": "T1EB1633257D9DEAA3CBFE8B386E306ABE1735E1703511D75375002BC8582A8BCB915E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776655, "uuid": "41cec9ae-4f87-4ae5-8c89-ea1c9d750b81", "value": "98304:WFKkSR+90cKFiolKjj3+JfNzs+I4jztL4EpcQEIpl:GKN+9m90H+JfNzDJztcEWQEul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776655, "uuid": "2cd631fb-2b4f-45ca-8e65-b55be4ca3c77", "value": 4232192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776655, "uuid": "43fd3c46-4507-407b-8e66-1ff2fc407922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776655, "uuid": "755f0e2f-b094-4d4c-b01a-ba257a11b935", "value": "1353993a93a17cb80e8e07b9adf7389d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda5a7ef-5699-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638797912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797912, "uuid": "51896dce-8583-4766-b0a7-72358b2426de", "comment": "Malware payload (AgentTesla)", "value": "488e2b95e47999b08cc1cd30c520c307", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797912, "uuid": "32f9b997-5d38-4d05-be12-6d0dcd7b4090", "comment": "Malware payload (AgentTesla)", "value": "ab491ef96c5a7866d7c0946b972911ecfa2cf05c5c8f532d58cb6c53ab267b4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797912, "uuid": "8c9eaa7c-9cda-4d2a-9228-e4042b6b4109", "comment": "Malware payload (AgentTesla)", "value": "6b3dbf285850b5a9952ba0516482fb83333cb119", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797912, "uuid": "e47e2c8e-38d7-42b2-abb0-6fa7446336b9", "comment": "Malware payload (AgentTesla)", "value": "40571e0ccad782de41dd7e67af4475fb573947b93e260de75605ed8e2197f84b04fec77a309b7199ee4960604150c0fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797912, "uuid": "eccefb30-cf61-4d66-b024-564e80badf1a", "value": "T1EF655A5C313125AFE83A853049540F379EF12C7D966B938E7317346BCABE9468F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797912, "uuid": "f34c7900-0649-4381-bb07-f568c8a5350e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797912, "uuid": "4ea470fc-c3ac-4742-8519-cd0d763fb8f8", "value": "24576:Thd/aLH4HmbvJth94ehlbAGuk+IFwRm1x38Uu4oVk9:L/aLumbHh94ClbL+IFAm15oVk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797912, "uuid": "33e17deb-38e0-427f-8fa1-df63aa09c9c5", "value": 1465856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797912, "uuid": "72c7d0d8-ab62-4a8f-a684-44717faad989", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797912, "uuid": "1667e8bf-ebe0-48c3-9e2a-0315cbd6e8e2", "value": "Product List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22749fce-566a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638777438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777438, "uuid": "5b3c6e1c-d714-4dd6-8e76-0ef8719b5adf", "comment": "Malware payload (Mirai)", "value": "44f497102a0f3a8b9179cc08a97d5262", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777438, "uuid": "e78fc249-a7cc-4c34-8e0b-59cb3da0bf95", "comment": "Malware payload (Mirai)", "value": "acc72f788663abe8ed816f20dc1cb5ce12431d3511de8502b7a1e45e2e786535", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777438, "uuid": "05459059-3231-49a8-b1ba-e6a658422c0e", "comment": "Malware payload (Mirai)", "value": "8f4f0432ba8f5f21d689ebc97efdc673b3355ce7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777438, "uuid": "542ff24d-184a-419a-8590-7a72f0545e02", "comment": "Malware payload (Mirai)", "value": "5b0c4e75b5e335539ea3ebd50778e9e5016d81f8fd056670698f676fba63d61fd266cf6bcda3dee955f8394ee31ca935", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777438, "uuid": "7b126caa-2ded-462d-9a70-2358e3558867", "value": "T1FA2302E086A17A63FB951830FA184C89D7D32C7D06FF6311121A736D51D88F1B7BD942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777438, "uuid": "772b9707-6079-48b9-af78-34dd2641b867", "value": "768:e2eqFA7kUuIlfVpPHRScShXXXTPWINVAp89UCusdrGf4THcs3Uoz1I:etaUucfVp/kcg/f28xIfkHZz1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638777438, "uuid": "6bc00690-d9c7-4334-bbfb-d5314cca756b", "value": 48796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638777438, "uuid": "aac62d95-467c-4cc5-a69f-0e7f3afbc448", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777438, "uuid": "2dca897f-d115-42b7-a0ef-156909d269bd", "value": "44f497102a0f3a8b9179cc08a97d5262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83011168-5698-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638797357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797357, "uuid": "b24092ec-5f63-457c-97e5-a23628ade5b6", "comment": "Malware payload (Formbook)", "value": "b1f666b1668871a55e7e22956a813ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797357, "uuid": "3f29393b-14d8-48fc-9065-759b63de1035", "comment": "Malware payload (Formbook)", "value": "ad33f1b47b2ac6b1ec5eea318baf1bfe8f9bb2f6d02fd1667da7aeeb351205e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797357, "uuid": "caefbd14-199a-402b-af88-f6eb50ed3c08", "comment": "Malware payload (Formbook)", "value": "b85d9c95faafc0c20eceaac17123382c0ad93f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797357, "uuid": "444c3010-839f-491f-907d-2a597391268b", "comment": "Malware payload (Formbook)", "value": "b676767e3f1f7adc8ea643543adb03f3c5b9997060e1e6810231b2754e42a33a94a23d1fa59bbf928cd08206578b4e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797357, "uuid": "272a8a9f-525b-416d-9256-d2e105ac380e", "value": "T10B74129296E4E467F2A783715D332296D3BFC2DCA377AA73DBC05F2A2C774898504058", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797357, "uuid": "5649d328-594a-4b65-8714-c9c0bb3c037c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797357, "uuid": "f348ea77-862a-40fe-8ef0-36a0e45c55b4", "value": "6144:rGiCh9pTRymvHCiv1No4vcYOrTTOQYyH0Mx+hmlYn9/rofWTKP:iQWCiv1NlvclR0MAhaY9jqpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797357, "uuid": "caffc9e6-4b29-4be0-81c1-42d2d6aee6fe", "value": 362660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797357, "uuid": "57e07425-fbfb-44d3-a870-8248bf3215ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797357, "uuid": "3abe0f64-6d98-4ba8-bd70-694c2d22b6cb", "value": "b1f666b1668871a55e7e22956a813ae5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182f7f00-569c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638798896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798896, "uuid": "acd8fc1c-bc9c-472f-ba69-42afa0d7ee47", "comment": "Malware payload (Formbook)", "value": "e9de6480e0583d57cbb969c7781a7aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798896, "uuid": "863858c6-d4d4-4e9e-8ebf-4c4f4e6bc66f", "comment": "Malware payload (Formbook)", "value": "ad94693e6550491b7d00000042ecad4a74d8a4af46bdd47c79245b0e321836ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798896, "uuid": "c75ebdca-ab2f-4f01-8412-bc90b71999e5", "comment": "Malware payload (Formbook)", "value": "bc8659373ff3a907e7e8ff22b08230a70ef20541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798896, "uuid": "115e39f9-0d97-4c73-953b-07a229cf17d5", "comment": "Malware payload (Formbook)", "value": "62ab5911d82e54afd0d8bc25818ba9ac278a5a7b096864e78cafba30a6764776132086e3459f1df6e490bb6ab53e8476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798896, "uuid": "22d03fd7-b77f-427b-956a-75155c4ca029", "value": "T18E74234B78852C73DD81193281F91F2EF3B3899722B8196B2F58FD2B1BD1181E468F95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798896, "uuid": "c822a074-3a7a-40fa-867c-e3eb804fbff1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798896, "uuid": "131330f5-2dff-44a2-ac39-5191a6c847ff", "value": "6144:rGia1byszw3DWGhsxMXBXJNU7aDGwUZQzL4LYvwm/Y2yvjZQj/vDSd+:W1byMYDWGhsqXJJNU2VUZQn40oeYDvjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638798896, "uuid": "fd6cb788-8c30-4e59-9087-791d6bf81594", "value": 362170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638798896, "uuid": "d3da1c6f-045a-4ba6-8a0c-a69070813361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798896, "uuid": "12139e1f-7f58-4655-b539-a5fb4237727b", "value": "jay.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c6368d-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638802294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802294, "uuid": "be3399bf-0839-42fd-a337-1ba0a4703296", "comment": "Malware payload (Dridex)", "value": "699634b29f6b64d1ef05a3c0bb1cdf56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802294, "uuid": "549906e6-d1e9-4ac5-bdff-aac0919e04f5", "comment": "Malware payload (Dridex)", "value": "ad9e830aca098f686bc0fe4f3c31efb30b40cb166f49896bdb4fa1f80c6c3492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802294, "uuid": "40899218-19c6-4aed-9c8a-bacc822f0d4f", "comment": "Malware payload (Dridex)", "value": "4666fe5bb8a9e8deaa2a19314efbc28b2992ee3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802294, "uuid": "bc311e2d-d00d-4c16-9b45-0a4e77260d22", "comment": "Malware payload (Dridex)", "value": "0e8984488ba956672ffd5292b2227549370b4fbe6f70c48d6a462513f053dc98df0df7f0396fddc178d8d6deeed27d6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802294, "uuid": "00884f1d-4dd2-429c-9b72-98f130592c84", "value": "T1A7A4AF469916A00DE80DA43DB34CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802294, "uuid": "7b7ca3e1-3a84-4da1-9a05-93c1d78f956e", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802294, "uuid": "f4740445-d01f-4af7-83fc-79a127d1dba4", "value": "12288:F7fimEsIsmY4K08oM1Wd8t5KQhNdv5z7:F7aVRBn7x6jt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802294, "uuid": "7e8234b9-2510-432c-952b-859b50787462", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802294, "uuid": "32f936b5-7156-40d0-a20f-c4216c29d5b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802294, "uuid": "9c6b311a-188c-4270-aecd-292ad5b8cec5", "value": "699634b29f6b64d1ef05a3c0bb1cdf56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091c6fc1-5688-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638790281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790281, "uuid": "2fdcf1de-def6-4e56-9461-644843778994", "comment": "Malware payload (AgentTesla)", "value": "0a9b7e32dbc775460971b3cb98dc8a58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790281, "uuid": "4763a23b-3023-4931-82cc-667cb772d804", "comment": "Malware payload (AgentTesla)", "value": "ae122da029cf7b8c33d7558a70b4886916dac097b6f3d3477a3c63a75c646679", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790281, "uuid": "3a58cba8-1b71-4e10-8435-33051297cb9c", "comment": "Malware payload (AgentTesla)", "value": "5f3a7b31ff1d01319da84de63fc5890dda655379", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790281, "uuid": "29227860-3ee3-4b5f-80e9-ab785fb959a2", "comment": "Malware payload (AgentTesla)", "value": "c9d9a16e6efd2f0c2d68cd8a82d148fa49fa8786406cdbbc546be9f72cc5e00d968474b62f5ff1c383d36527d879f6eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790281, "uuid": "73d5aa3f-aced-4e87-823a-1db7b58748a1", "value": "T1D4357C7AA882D055FF4063F6721655BA4E8CE5CF26039BD8B2043D835A75243F27F8AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790281, "uuid": "d4009a5c-4b09-42b8-89a3-7ef5fb3c7e39", "value": "6144:Ia7r/QcKErb9ondtU/1rTn7ZZIUC9O3iYc9GUiGi0szq5yjeqVpOPTcgPn1/6z4a:IumEv+ClT7ZZa9M7sA4Fd+yPzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790281, "uuid": "ab8c1af8-70bd-4d2a-a3a3-96b7296bd06f", "value": 1119172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790281, "uuid": "451fdf46-6e5f-4bab-ac8f-8f0e5718408d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790281, "uuid": "aed40278-d7f6-47df-98f2-740bd4b8784a", "value": "Require further details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81398fbb-5671-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638780604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "38bd2853-be06-42e3-a686-e5c3ed8f0219", "comment": "Malware payload (Mirai)", "value": "bdeb4e5149ba111ffa77342450875071", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "e64db956-4eb0-43be-863a-251c09ddd7aa", "comment": "Malware payload (Mirai)", "value": "aec5fcb3018257e3fd96f61dde0f8eba1e2a4bc1ffca928c701dc392d5770946", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "ff954672-ddc4-451e-b2d6-f06090a5002d", "comment": "Malware payload (Mirai)", "value": "2e39836131c260f5874b772cbcd4438aea172bd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780604, "uuid": "ec08bae1-de19-4cbb-981e-dc1d5a1485e5", "comment": "Malware payload (Mirai)", "value": "10f64f46966684e02eaae47ef85c4dc8070ba0bfb0d9ec5888675277e6b4a7ae770ca4bac62b9191d83568515e1b4d28", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "8b617a5d-4a6a-4404-a378-a068faa32e19", "value": "T137933C81F743C6B3C84307B2029BAA564931F67B0A2A9E4AF31D7DF4AB138C57215F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "1d92a6dd-1f1d-4e07-96c5-3fc2634acd0c", "value": "1536:ATjawRJIwIWJ8OeKfpJ7QSYzZAjZbdNvliLJJHDQ+NhIzAvM9Kz/Y:AawoyWOeKfpJ8SY+jZHUXHDPNhIzAE97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638780604, "uuid": "e844501b-8434-438e-b109-6e4a8f669a80", "value": 94310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638780604, "uuid": "667d4ea9-f717-4f92-8e71-ec0f794cb4e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780604, "uuid": "bbc50915-0f71-449d-872f-66077c946599", "value": "razdzn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2653e97-5694-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638795799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795799, "uuid": "e9584643-3dcc-448f-a78e-6069a8f77827", "comment": "Malware payload (RemcosRAT)", "value": "b94861f5509c2dc58cf12457f00a8ec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795799, "uuid": "fbcea84c-a986-4a5f-a74e-d77e039fe566", "comment": "Malware payload (RemcosRAT)", "value": "af171290cc03d72c2c1272b039193cb71fdec5b612330f832dad2220753cb406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795799, "uuid": "65133aca-6cef-4f43-b10d-123b76598b54", "comment": "Malware payload (RemcosRAT)", "value": "0eda47b292df3819a57b0e8865d8371a98a6d259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795799, "uuid": "ae8cb129-d1cf-4d56-a018-10b7b02e22bf", "comment": "Malware payload (RemcosRAT)", "value": "ca4592cd7a199f1fa2fb43cda43aeee3475c24fde9b4f512084cc29d070054948472deb4b34352dc53ab229dae2ad861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795799, "uuid": "816abe6a-60cf-4e82-9a49-ed09ca617e5e", "value": "T121E47B0EAA11D245F84CBF74FA7F3BB00790BDA7ED55920FA2447EADA43A37518C4642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795799, "uuid": "1092cb6a-e07b-4129-a991-9b6220226fb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795799, "uuid": "c6b8cc82-d0d1-4238-88e1-1dab1ed6450a", "value": "12288:ZXBv7K++ajMfWxVlj+MzUfV2Bo5xzOAN8yeRu/1S4fUBLBe:ZXI+5jZH+MgzXKAN8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795799, "uuid": "7eabc087-1380-45e8-a7c9-57baceea5b53", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795799, "uuid": "058891a8-d0a4-4d07-be48-33073f3791ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795799, "uuid": "020aaa06-cd94-4e68-a00d-05de5b67906a", "value": "b94861f5509c2dc58cf12457f00a8ec0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9850a183-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638802547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802547, "uuid": "d1809513-b5ed-46eb-bc6f-bbce2724f811", "comment": "Malware payload (Formbook)", "value": "586db006f3320cb9a41a62f7f5a0c4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802547, "uuid": "47b0d368-da95-41ca-b235-3ec9e429f402", "comment": "Malware payload (Formbook)", "value": "af2a8024939f13bee37b6d3a35aa5df93e2a6b11cede4bea19493c4d704b050f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802547, "uuid": "f07ab41c-6e26-4155-8cdb-dead92125099", "comment": "Malware payload (Formbook)", "value": "3b6f558429e9fe51b191dfbb63bdc7161d95870a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802547, "uuid": "a046a96e-57d5-4344-96ad-d3179075e1c3", "comment": "Malware payload (Formbook)", "value": "bbd9af77722196258232803f2e282903d81d63e422ec1d0d3055b66179e757ad5096aac1f90b4d8b69b90a481985936c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802547, "uuid": "75d3611c-2746-432a-b428-741d5c8d3f96", "value": "T13E358C35B260D873C23B16B8CC57E7E81525BF206A15AE873BF57C4E1EF9650B416283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802547, "uuid": "696cfa8e-74ca-4744-ba7f-1f4ad893cac1", "value": "63129113d28408f1ff3b0b14b238be7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802547, "uuid": "01e3152b-650b-41cb-8754-491a67a62d3e", "value": "12288:IZLuO0wmv2pdKSKVLmbPy7PXjW1ebIrUxhmKQHwy22NwtIKmmTIy72TTTTTTTTTG:4CRv2pvAmbPy7PaYbIryhmNgtIKue5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802547, "uuid": "b7ee1a38-eb23-4e58-944d-27650427ad70", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802547, "uuid": "4b35e7da-a4ce-4693-9dab-02d1dc75acbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802547, "uuid": "3f49b385-f3db-49ab-8355-c847528c22a3", "value": "u prilogu je nova narudzba za kupnju.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19dc1f09-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638772270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772270, "uuid": "23306124-5a3a-44f9-aae7-ac5e1c9e1d23", "comment": "Malware payload (Formbook)", "value": "9f5094328e87a38e3839c741c85c3ac6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772270, "uuid": "f21f7b49-75ca-482d-aecd-24746f0a11e9", "comment": "Malware payload (Formbook)", "value": "b0317fe6426ee5247b933cb3b5cf2c0c59d58b3bdcd27c636bf03a75c2e2609c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772270, "uuid": "df78bb84-e32c-44de-8d99-8ab1755d36b6", "comment": "Malware payload (Formbook)", "value": "50703316c674cc5df15742cebc39e3356328f676", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772270, "uuid": "c58ec210-aca9-43bc-bea6-fab3eeac8e21", "comment": "Malware payload (Formbook)", "value": "db9ea4773af4cafbc9c73094e58f0c843449577fda965d0b0e4d56e2e4f015eae85ec2139f6fca370325f07b9e4961d8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772270, "uuid": "6e7b595f-7cc9-49dc-9ca5-2e76f550e90f", "value": "T174F3121CB754CF1EDD22DBF0BA662654A368BF02ADB79843DD093E05523CE91DE07609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772270, "uuid": "66ab4302-24b4-4056-bf4b-d7a43b48d195", "value": "3072:Dzs37biyu6BfR4euLcIQk4HahM2mvlqI/pbJ+gFxt8idsHvjR9HkT6sM04Hy3h:n6u6BfJk4601hbJ7xth0XkWS4H2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772270, "uuid": "9fcb835e-35b4-4c47-b847-9e2255539e30", "value": 164408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772270, "uuid": "5eea6090-6eaa-4dd9-bb89-e41769b74721", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772270, "uuid": "431fc97d-997f-4595-99f3-16334998722b", "value": "BD10752Q0040731BDDHK.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bbc0bb-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638760428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760428, "uuid": "f4fb70a0-bb95-41aa-b7db-c6173356b4ad", "comment": "Malware payload (RedLineStealer)", "value": "70b4ef956387f278031f19a3b4447125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760428, "uuid": "a7b479c7-a082-4bc4-aa2b-ddb4cef893c6", "comment": "Malware payload (RedLineStealer)", "value": "b0b8fc38cd895f30f18806c0f6029192ac22d09829efb1ae38df95296c585cd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760428, "uuid": "1343ad82-7106-4d4e-a348-15dfcb1b5b89", "comment": "Malware payload (RedLineStealer)", "value": "ad6de959adbb818c2e872bd357bdf9b66463e992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760428, "uuid": "fddcf4d1-267d-4a4e-8523-920bd8573d7d", "comment": "Malware payload (RedLineStealer)", "value": "6cef457543bfbf531e535173d9c9d8933a5e49ea7757532f4dbe45ff3270127d43595134670af6d6a069174890121ec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760428, "uuid": "fb775c99-3f5b-4865-9894-d3c97f82ce6e", "value": "T15AA32A6437DC8A15E2FF0E70BCB0111443F0E5A36412E75F4DC564EA2E76B91AA26AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760428, "uuid": "5adb6886-9cea-40d7-8948-40744fdc5fd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760428, "uuid": "963e257d-8ff3-461b-8253-2a78933d8ded", "value": "3072:2DH7D4w3cseoMNdXApFtMHkuQL3UQ/brNYI9v4Nh9:E4scseoMNwsQ1m9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760428, "uuid": "034a0ea2-c589-40b3-a130-a82242c6f5cc", "value": 106712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760428, "uuid": "6a2aba54-3ce8-4c6d-ac65-b9c4bcc35966", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760428, "uuid": "9b6ab792-97ed-415f-bdb5-6b95548697ef", "value": "SecuriteInfo.com.Trojan.PWS.Steam.21709.30531.29480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5079e4b4-5662-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638774079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774079, "uuid": "022d483a-c91f-4f20-a6ff-3330d0a7d485", "comment": "Malware payload (Loki)", "value": "cb2441099d6f5e62e912dafe7d4159c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774079, "uuid": "ca32701c-208f-44fc-9846-41206875cf3b", "comment": "Malware payload (Loki)", "value": "b14df7e61bbbe9158b2851136d18c942b22629df86ccf9d25a0522da43eee9a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774079, "uuid": "d6c7275c-b89a-4627-bc46-bc9e4164bbf4", "comment": "Malware payload (Loki)", "value": "7b1874dd66b87c86126176078b5bc2ca29c6be0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774079, "uuid": "3c627c5a-a0b3-41af-9cca-4f119250108e", "comment": "Malware payload (Loki)", "value": "52bbeb18c43a6902a93731b3e3155bd497586f9ddf1fc27e016afb48b6591ca3af67009f61a54cecb1c424b2700599a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774079, "uuid": "f2da1959-12de-4049-88b8-5a2f36c33074", "value": "T153456A1D26B5096BE97D1A34142147374EF26C3D99BBE3CD3B48356B0BB26800B267ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774079, "uuid": "2f89e9d3-130e-4879-8888-f2a4491ad6f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774079, "uuid": "25cb540c-fe56-466e-803e-9b642c70573c", "value": "24576:KryImhr3hq6tDfAhN4YhWao9pVhMPEUtkayarvonzpsJu5WhULr:KMdzAR0aIiEUVvO5WhULr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638774079, "uuid": "59904ab9-2406-4450-ae4e-cd93386c9a0f", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638774079, "uuid": "0ac703de-5d98-4377-b319-9ae578d1520f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774079, "uuid": "d54dfe87-08cd-4bee-8394-a694ec6f86ba", "value": "RHY009878999.BAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b71816-568b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638791649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791649, "uuid": "127b728d-06b6-4d91-b847-ee41feae7433", "comment": "Malware payload (AgentTesla)", "value": "08dba48a8d5b320879856dd8cedcba30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791649, "uuid": "17006c16-5466-48d0-992d-8c5218fbc575", "comment": "Malware payload (AgentTesla)", "value": "b1626c65a103c92a6702dc18793abcae9ee8c2199bcb550f5d8151fc54ea1aa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791649, "uuid": "3d0932fe-46e8-44ba-92b1-0f181c4721d0", "comment": "Malware payload (AgentTesla)", "value": "fbb9f2afb3b6f7215be485e47aa930c527d6d2a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791649, "uuid": "65e56c97-ca8b-42b7-a300-3f707f525033", "comment": "Malware payload (AgentTesla)", "value": "83cd197f81cec48be4ce860ddceab70790b2bf004f222219668eeee8c072a6c55f6b6531660ec3a278f6957a516fdfcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791649, "uuid": "cf8aabaf-a072-4a50-b258-ae4ea0623ae6", "value": "T1BB656B5C317025AFE83A853045540F3B9EF12C7D866B53CE731734AB8ABD9868F252E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791649, "uuid": "e8b1eeff-a5d8-4b2e-876c-1f24b406f3a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791649, "uuid": "70589d9c-d350-427a-813d-e6135ace33de", "value": "24576:2kuo0L5/DSn989Dht4E46a+oVzbR8PaDG+gd4IOn2:21VL5/2nmtgT6a+oX8AG+Y4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791649, "uuid": "82cae4c6-7b1b-45b7-ae55-d96ddb3480cd", "value": 1438720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791649, "uuid": "640954e4-d311-41cc-a233-e271c2748b72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791649, "uuid": "887b6c7e-556c-49b1-823f-af3a0daa3459", "value": "08dba48a8d5b320879856dd8cedcba30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba08b55b-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638789718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789718, "uuid": "dfdee0dc-fc4b-4865-88ab-63aefe6cdf7b", "comment": "Malware payload (Formbook)", "value": "4ea4e3f82c027a9bbfae48369e06a1e7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789718, "uuid": "57023d3a-b092-4d4c-a1fc-bcff43fe0914", "comment": "Malware payload (Formbook)", "value": "b185bb70a6354a82f1350a0609aae9f3c9eeddcf4cc5c17ce17ea063b6ef98f9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789718, "uuid": "bb6c49e5-1a45-4a60-9d70-df47f8254bf3", "comment": "Malware payload (Formbook)", "value": "201c760219ecbd1ecf4755feaaf6e28e7990527c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789718, "uuid": "325ab934-0c1d-4118-bfef-f07f74456a93", "comment": "Malware payload (Formbook)", "value": "b8578706b48695e11006b03f8846718809e8038c32192f1a47045b901f31d5070fd4a679ffd4b180ad917d688487bd43", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789718, "uuid": "6a8b2869-0fcc-4030-bc78-4aafdb8be4ea", "value": "T1EB341228EC91C21AFF61037BA5C0BDD7C6A8EC6516A92115B7E536563D7382B00F6F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789718, "uuid": "bab2efa4-891f-4976-ad0a-34b9cee87c38", "value": "6144:4OfUaLGhiXt1Vu5pi7L6PTYYYQg7hGtP/Zovwk:OaLyet1VvdYYQg7hGNZel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789718, "uuid": "b36720a9-fc04-4b45-bc41-73fc5eb97bf6", "value": 234568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789718, "uuid": "b152c4b9-67fc-4eb0-9065-561ad32f38d3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789718, "uuid": "e9d259f3-c288-4155-8ada-a69c3187914b", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb6811e-568b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638791661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791661, "uuid": "9b650203-7604-4b60-8f1b-c3fab1976934", "comment": "Malware payload (Formbook)", "value": "302af20334bad2c4c6d9c6fa86786c87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791661, "uuid": "e34544e2-1c03-40d6-879d-6f6b049c5ccd", "comment": "Malware payload (Formbook)", "value": "b19fd4dfc771a8d5f623d780c5e3f184072a267c37ec9b9c04b77cc2c341d685", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791661, "uuid": "f0ed15d9-2c87-4706-96b0-baa658a35c29", "comment": "Malware payload (Formbook)", "value": "e2017f80a5ac8782e31f4c23e16d861afe5003e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791661, "uuid": "7d0bdb93-6f45-4c5a-a2f9-9d7275ba65f3", "comment": "Malware payload (Formbook)", "value": "3f246c70fda568f81dbf7834551f0712464d944a9eb8c7313221b2ba89cec2718b3b194a2e2947e48c6e4e167e9a5053", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791661, "uuid": "abfc22ff-944b-461d-84b0-38f0f377be55", "value": "T13574230B37E1A02AF263063209735B6CDBBBB75120127D1B4FF84E654B135A3D2596BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791661, "uuid": "76452f97-2ac0-4576-9723-2a04f27c6b0e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791661, "uuid": "e2b06327-eceb-4956-95a7-2de7a4399fa0", "value": "6144:rGiJmFAvto2+jUhZkh4ogvhZBXreqBTy+0kubpFkhZHSGZB:oFEtz1Xkbgvzxeu0k4QZFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791661, "uuid": "f389f78b-2751-4fe9-a940-986edde80b9f", "value": 364961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791661, "uuid": "ceaeed82-ff4f-4ecb-a470-b48b1cde7a38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791661, "uuid": "b77a77dd-f3e6-42e4-a274-4733d81153cc", "value": "302af20334bad2c4c6d9c6fa86786c87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5316cf0c-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1638808873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808873, "uuid": "bd2f9e3f-182c-4b46-abb8-003d4786b0b7", "comment": "Malware payload (Quakbot)", "value": "bf48d21f789158a5223a6131e721c58d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808873, "uuid": "71d530a8-31fa-4ea4-93a2-6e0bcbea9b0f", "comment": "Malware payload (Quakbot)", "value": "b39a0b57089dd2317f6a4d5ee6ae886fbeef16c1bdc06c48ce5eedd46df7708e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808873, "uuid": "38783aed-399d-42c2-9497-3f13af762b4b", "comment": "Malware payload (Quakbot)", "value": "943917124b632821bc92ba5075baf448d172f96b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808873, "uuid": "f65b5b71-263b-4e95-967a-d4c4234139e6", "comment": "Malware payload (Quakbot)", "value": "776998be50135906c5cc8eafb52e11a27e112eaf9101d4516ef99ce3bb9fa2aefe867f2514822637a8ac3e1c2863dc45", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808873, "uuid": "57db0bef-e0cc-487e-b763-9c4a7e32ca4f", "value": "T1045301DEF2130D87A1723EEE4AD0C1D37E15CD3B5692F876ECD916E21E1A86680F0919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808873, "uuid": "fedcd165-5f0c-4c68-9c8e-62472206c684", "value": "768:f2xu9qD+5libhYwYt7tjbeVr1bTmBEtB39ne3mPumlf9XCzxVEKhb8I/9PIOXpgr:f24a+WMJonmB2dyVVEKhbFQIggooZB6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638808873, "uuid": "07043754-264d-4f60-b8ed-2306cc639d1a", "value": 62101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638808873, "uuid": "8ee0a919-6a27-48a8-8a26-4beb02797c23", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808873, "uuid": "1f480a6e-3c82-4a8b-9ae8-1b408eaa046c", "value": "q-2377536609(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5781f0a-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638789711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789711, "uuid": "9ffd96df-a7e1-4b34-859f-9f78ec3669c8", "comment": "Malware payload (AgentTesla)", "value": "979442341ac1d58857627cff3806447c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789711, "uuid": "f80dffbd-72bc-4dca-bd10-d505c384e48e", "comment": "Malware payload (AgentTesla)", "value": "b3ae3394812ef8fb4be1fdc8f917854e2e5af71235422c2f17983bc89d5358a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789711, "uuid": "675b4bc4-454e-4972-87d1-eaa509ce892c", "comment": "Malware payload (AgentTesla)", "value": "a137ff53e9c6de24348949c4e14c14ce301e6c59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789711, "uuid": "a09a4adc-9124-42f9-a29b-bf3bf2d8b827", "comment": "Malware payload (AgentTesla)", "value": "d7f9e9b2b6226b540ffca4af3f0b9ab80a8d6d780cf0dc824f3001be858e9e6d926c40383c0d24c4147d36f81fe06e83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789711, "uuid": "fc984e60-5d1f-4ecb-971b-a211cdd7bedb", "value": "T146A22DBCD05706A88F46A7F8671B6F46048CB62EF3859632727CA77467D2C7A402383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789711, "uuid": "15eccfe2-7440-4209-8da6-a049488ccd70", "value": "384:opbxy2m7SKNz0Z3cMW3eGNN2vp6affDzASkWWlxiO71HJXmyv:oI2sS9czzUx6yM911myv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789711, "uuid": "3dd0699a-ca93-4d36-a3d4-466a4caedc17", "value": 23306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789711, "uuid": "54510aa3-20c9-47f2-8540-1ac0a27a4b1c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789711, "uuid": "777e6df5-c40f-4dcb-8d91-eb0b922f14aa", "value": "PURCHASE ORDER 256.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479e9b6d-56b7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638810572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810572, "uuid": "9171c168-7a6e-4721-9a5e-64ba817cfce1", "comment": "Malware payload (Smoke Loader)", "value": "d84ec0c883cc6b01e916057486af714a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810572, "uuid": "fd266665-ebc1-495f-b4f8-3aaf29746f80", "comment": "Malware payload (Smoke Loader)", "value": "b506ab741a611aa5d273c6ff627317d4ba12d634dc45097cca73d182833f6d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810572, "uuid": "c4092e14-c29e-4c19-acd7-f4c63d8c8d75", "comment": "Malware payload (Smoke Loader)", "value": "adbae66440bb0932593b5132a4b247f769816080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810572, "uuid": "b0f8fceb-49f6-4306-9556-4cf823269ffd", "comment": "Malware payload (Smoke Loader)", "value": "f50e7885249a7fe83682c044bcd1fce0aa8652ec45c45b01bc20fe901667659be0afd295e2d55ff9c53ac4fc423e1ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810572, "uuid": "d8cd2d90-43f0-4a21-b009-d4a04bece616", "value": "T1C2D4F11232C1C036C0F625768526D6F64EBB783906665A8F7FC85BB95F783D0AB2530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810572, "uuid": "7f6f17ac-96df-4003-8517-6a8bcb9bd641", "value": "56620115eb6e0830bdf5b4ae97062a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810572, "uuid": "2c26b36c-bf95-4933-bca0-fd2101433e88", "value": "12288:kp7BlG4xOHV+2u0lUzFaIxc+uaWnlPKedZI8jXWZRtM:ibG4xOsBzFaIxJWnlyedvezM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638810572, "uuid": "7ca4ccdb-e051-496f-b749-2b8b6d020742", "value": 602159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638810572, "uuid": "74993482-2c58-483f-83dc-1dd50ad1b013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810572, "uuid": "9a2c686b-9327-4723-9646-45fa5ff121a8", "value": "11200.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef66f15-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638765057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765057, "uuid": "10889a4e-2100-46a4-8730-69532cd3d0fb", "comment": "Malware payload (CoinMiner)", "value": "4b436dcaedc9087d301c8f6bf6f77922", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765057, "uuid": "6755f10a-e7d9-4893-a615-86e2c28f0009", "comment": "Malware payload (CoinMiner)", "value": "b57f69913740f87b3c6321c7e0a36be68b6a9769b755b444820c2d1a841198fa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765057, "uuid": "f574fe02-0af4-4929-a9e6-eaa8820d9264", "comment": "Malware payload (CoinMiner)", "value": "e3050f013a3fea55f8403ef79c3477ad4c7c0069", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765057, "uuid": "5cadb7fd-7f71-4009-a849-c8d77c26b1f1", "comment": "Malware payload (CoinMiner)", "value": "b42d10ef3eb37a2324ce26e3a3efe3d0af058946f63d45f93c09016211f6a6ef2bf2b40ecdae5a629524d81bcfea0906", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765057, "uuid": "bdeaa823-5ea8-4f41-98e2-292ef2973b80", "value": "T17A36335AA84CA5D6DC86F0BAA4BF906FDBF31337FAFA45935310956E978E84114CF002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765057, "uuid": "f0ee298c-2d22-42c5-9690-23c0128f3018", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765057, "uuid": "ee6ca42e-3fa8-4881-b6f2-a8be6489f0f9", "value": "98304:zjnEGPu8ujONGmsd5kSwJ/vID0JdtcQDlr75LrSbpjFQ52yYSa:z+vONRsI3s0JFBSbViMSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765057, "uuid": "6f50c414-3169-45f4-8da2-2cdcd7939ae9", "value": 5301248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765057, "uuid": "46baac46-d717-47ab-b19c-824c7baca429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765057, "uuid": "2a9035cf-e12d-4eb3-aa40-5cad89d200e8", "value": "SecuriteInfo.com.Trojan.GenericKDZ.80635.6430.1717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27065810-56e0-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638828126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638828126, "uuid": "c9289040-8bb5-42f3-a412-07f4db3e157d", "comment": "Malware payload (RedLineStealer)", "value": "a3d4802cad579811bc5955b247fac7d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638828126, "uuid": "b3c87948-a588-464c-9645-0b4afb75abd1", "comment": "Malware payload (RedLineStealer)", "value": "b5e2cc650d28480b8fcd283ec22941720735f5591f75f29b3855e25ba9897695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638828126, "uuid": "08c80a67-cab9-4deb-8d39-954e52ce456d", "comment": "Malware payload (RedLineStealer)", "value": "33acfceaaa77deb6aa1fa9fd919d02ebb73e0979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638828126, "uuid": "767baa47-0c34-408f-ac48-2a57659f13e8", "comment": "Malware payload (RedLineStealer)", "value": "c7108221c1838ca491d936d812795e7638644842199757d3796c3ab0a3e92a570a5c73a6a2058ce04a93608d856c5748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638828126, "uuid": "55e4f88e-ca27-4c61-b2aa-8a598324681e", "value": "T18075F52BB70C424DF904283AA0C2FA05EB1456D5AEFEF5E4DB7BAD473742CE4714A1A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638828126, "uuid": "1dc6c534-b06f-4c3e-b3af-7e6d241ed17b", "value": "cdb178ddf5c979e2bdd4cfd4cec8f9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638828126, "uuid": "3fa5864a-4949-4403-a1b5-ff606a7ad4ef", "value": "24576:12WuJrCAfYGN7gsWkXPMqg6+KazUqOHuouJCvOR:123JOAfYGRik/MEAUqjoH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638828126, "uuid": "b188e322-b87f-48e5-863d-6d92561e9451", "value": 1692416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638828126, "uuid": "9e8ded28-e399-4c12-a975-5a316e2184ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638828126, "uuid": "466639ce-1cab-4cb2-b914-bce5b4c4407d", "value": "a3d4802cad579811bc5955b247fac7d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fa3eb4-5688-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638790651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790651, "uuid": "244800de-9702-4d90-93c1-820e88d6d93a", "comment": "Malware payload (AgentTesla)", "value": "7bf868b2ff4e455aaa61b743e658104c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790651, "uuid": "b636f852-dec5-47c1-b74b-52179e57de70", "comment": "Malware payload (AgentTesla)", "value": "b6f0c7aa6407fa36cd09aa606414e9a2b9a769efafd609030cbbdd173f88d9e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790651, "uuid": "ee84af48-62f9-4a40-88c7-6e93ce19bc76", "comment": "Malware payload (AgentTesla)", "value": "65080a6823b401c2b7e88f14b5b92a213e792c5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790651, "uuid": "c4178dd5-207e-4735-9bed-561ee718bfd4", "comment": "Malware payload (AgentTesla)", "value": "31b171ebc4bec8c50d3e9a93494380208b9aebca52657038b2b36161b9427aef2090dc9722b62517aa8fe824f11aedee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790651, "uuid": "a7aef0d8-3b32-4acf-9195-8cb36c6b3e51", "value": "T14D657B5C317025AFE83A853145541F379EF12C3D866B93CE731734AB8ABE5868F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790651, "uuid": "9a5b7bcb-fa4a-4400-9682-04a8b45daa0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790651, "uuid": "d3d21ff3-3f55-4ae6-a608-dadb09e9259c", "value": "24576:rKdLvF5Rpte4xMZkuvwhK5uBlUItYWiyH9T9wqWZo3wepP:rKdLvFvzRxM3vENUIRpmqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790651, "uuid": "7a7d35c2-f28b-4046-add1-d23ba0cd58f5", "value": 1425920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790651, "uuid": "6cd21914-320a-4848-91a1-75392e75a7ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790651, "uuid": "6a66d1e8-800e-409b-aaf1-5417e36672f5", "value": "Po new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7a8ba7-568c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638792325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792325, "uuid": "9dee35b2-0b30-4443-8214-e027177f49af", "comment": "Malware payload (Dridex)", "value": "bc311dfaae567d85af644f0e02f55551", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792325, "uuid": "a8057229-1bda-4fe3-9051-dd6aedf8335e", "comment": "Malware payload (Dridex)", "value": "b7c8fa282d0db4cb510325a4183dae5fd229b2e4f47b827a2d3cddd8889feb41", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792325, "uuid": "b0cf4c2e-e8ee-4c46-8fe6-f57d0fd175af", "comment": "Malware payload (Dridex)", "value": "71f473b06eea94b4c73567d268f185c9695b30b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792325, "uuid": "99866d3c-307c-4423-8e6e-ffb22248afcc", "comment": "Malware payload (Dridex)", "value": "d1d7800daa7f43e6cfec30656db77fe072ed693beb8c9313f1c0f1fe48ded539bc1b10a5a41af1b467c3333168735f6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792325, "uuid": "312efc7c-3800-4ca4-9ce2-c725271b43fc", "value": "T101A4D0C9C9F1ED19CE5C17389B5482BF12D24AAAFB73C8D9142C38D0557E04B7A6E42B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792325, "uuid": "a3ad5d42-7c97-4c88-93e9-1fd2f04a7c89", "value": "25b0bc93ee5d63fd4e903616b53abcaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792325, "uuid": "b01d199c-46ef-4cf5-bec3-48fa0e58262c", "value": "12288:xV3oeCf5A4RBa/+9C1Cha/CXC5C7C5CVAVIpCBCe:xV4lAVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638792325, "uuid": "da11aa6c-2669-4b13-b11d-d1752a9c5598", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638792325, "uuid": "ec704f63-acce-4868-a8de-5cb9ec818737", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792325, "uuid": "d23acff6-694f-423b-bc59-a144237f49a3", "value": "laixgv.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9fcf36-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638760406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760406, "uuid": "b1083167-3fab-4a06-a8b8-132847a85aaf", "comment": "Malware payload (Amadey)", "value": "b78bcfe57e728c3261e5213d14f73835", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760406, "uuid": "31c0061b-b28b-4703-a339-dc931f5fcc6b", "comment": "Malware payload (Amadey)", "value": "b8086b28e3e484018f7131b15a0143bbf85c5d9e1fe12de8703f4849c9b8a6e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760406, "uuid": "505f936f-1c1a-4b60-bc97-333813492947", "comment": "Malware payload (Amadey)", "value": "f7fa7ff2ec876fee46b837ff3a9abfc0aabcd641", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760406, "uuid": "504154fc-7eec-4bc5-a8dc-013ebfaed030", "comment": "Malware payload (Amadey)", "value": "e3ce3e80c674280f02a4429eea42160fe99483aaa16f4fde8a469d47dcc28a8be8cc89c09fc89b6f7a0def2be983198f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760406, "uuid": "f4af9730-2bd1-4dcb-958a-7bdeb6b25940", "value": "T15DD412336755891AD2E9173ED5AEFA2C03B89CE27821DB157AD634DA3DB33C204116CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760406, "uuid": "24a31970-e57f-442e-92a5-f8229b27d95f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760406, "uuid": "bd4d5db0-ec7b-4bcd-9a94-304bdfc67875", "value": "12288:ISjxeSulIfTP83xLA3ymsNMaROqKfRsydzw9kb7Duf:ISjf3fDU0etRpK5SAuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760406, "uuid": "0a6a27a7-e291-4404-b809-aa88b2b38551", "value": 608000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760406, "uuid": "6e00f2a3-3c30-4efa-8f42-c97a9e3e7d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760406, "uuid": "01597342-706c-4aa7-8abc-1fce16b7576e", "value": "SecuriteInfo.com.Trojan.GenericKD.38110898.31187.3650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078e5b5a-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638772239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772239, "uuid": "245451c4-23ff-4f0e-8077-b0a139edfcb8", "comment": "Malware payload", "value": "4b6dd769760d85cf66a91c8d51787987", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772239, "uuid": "2e21490c-7ad2-48a1-a6c4-9f217c34dd16", "comment": "Malware payload", "value": "b8385756b81892ba77ddd8564240f908fb799e27f7de363f97b48423799facad", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772239, "uuid": "434762ad-001f-4f8e-bd3b-ada4383412ba", "comment": "Malware payload", "value": "36630d759c4fdaea656eeeceb637dce2cc3ebddc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772239, "uuid": "637a684d-caad-4bb0-97eb-d8413230841a", "comment": "Malware payload", "value": "379ed17178bbfc44d3af0f65fe23676e7914889c7ce0eeaefafe862c28b99bd60bda5067df545df500c35c5c816bff1e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772239, "uuid": "cb38a2b6-40d0-490e-9bc7-9505b1dc17b6", "value": "T1F0F49E11B2D9C536D8BF02B06D3E97695638BEA48BF2C0DF13C4695E1D726C05632FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772239, "uuid": "99e95ab4-fcea-41a3-a838-ea40a3233c28", "value": "12288:4WnZfY8owv43bqKlRH1Vq9iyXsAl9cMJr280:4WnBY8owvitjVqoAsAP280", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772239, "uuid": "ec828829-1159-43a4-82ab-bc2e340ddbcb", "value": 724296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772239, "uuid": "e68886f6-fa57-4ca4-8d1b-e4374b01499b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772239, "uuid": "a074c947-5c6b-4be7-9f66-eb9730af1353", "value": "NOTA_FISCAL_2021.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc16bd0-56c4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638816142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816142, "uuid": "9983342a-ce79-4a11-b4e9-6a449695637c", "comment": "Malware payload", "value": "253d86c688e745030e5ac4943de3904c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816142, "uuid": "a00cc84e-f1f1-475e-b67e-90abe06e343c", "comment": "Malware payload", "value": "b89bdf302ab8af739b11bc964912dc80acc1e92752b44271b6f3f2bf175b5b3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816142, "uuid": "191ab41a-36f3-4707-bba7-5ae458f31233", "comment": "Malware payload", "value": "22bd87b4ab3799aad9a9e22ce23c4705b8becc34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638816142, "uuid": "d78bc5e2-119c-4020-bbfa-0a3a6cbd0563", "comment": "Malware payload", "value": "8b437aaa486ba77d846c302604f1f09ae84e69f97407bf4e0e4f53b3be831f0c1b2522aa4c274e105850208ffe64b6c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816142, "uuid": "04fc05fb-703d-4a8d-b8e7-ae9c791acd12", "value": "T18723B4A2B292E94AD95907354CD7C7E63636FC116F57834B3284F72F2FB26C08A02657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816142, "uuid": "9f4ab7a9-cb92-4c7c-b112-2caf23bdc7cd", "value": "768:1lSk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ3fJRnXYIm417YQQPKyRw1QmX6R:vSk3hbdlylKsgqopeJBWhZFGkE+cL2Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638816142, "uuid": "4fe358dd-e339-45b3-b901-7b21dc69ae0f", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638816142, "uuid": "48693ec3-a30b-44c6-896b-0faf1982f298", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638816142, "uuid": "7934237b-a9d4-4541-8451-62a553d10c2f", "value": "SecuriteInfo.com.Trojan.MSOffice.SLoad.ac.9315.26097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324ad7a0-56c3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638815690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815690, "uuid": "4e4a908e-8546-4b19-b34d-b89e8d4c98b2", "comment": "Malware payload", "value": "889a0ff0647954b1a56d7ec64c6fc524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815690, "uuid": "f128fe43-3e80-454e-a4e2-402229569b2f", "comment": "Malware payload", "value": "b8a325d5f7fc88c2ce7ce9a9375851e8ce88221087e9e6236083743080ffb523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815690, "uuid": "84bb8f94-819d-4795-8945-3b35a6a7e4a5", "comment": "Malware payload", "value": "b309cb48539c4b1cdf38177370274fdb86d18de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638815690, "uuid": "881461fc-8c3b-48af-90ef-24a30f0f7922", "comment": "Malware payload", "value": "7e046f703f37f85c52a1726ad82622e375b9dbb9f04c37634b6df03724d6aba25778c2d549bb9bb2efac4be4f0413471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815690, "uuid": "0c14630d-fb8a-4e71-9df2-1ea2a5c48ca1", "value": "T10107333BB668A53FC56A0B3245B3D36068BB7B65681A4C1E57F0090CCF36AB11E3E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815690, "uuid": "68f559a4-8461-4651-9ba0-5e17e7339fd9", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815690, "uuid": "83ae841f-35a6-4e1f-a40d-f340832e2684", "value": "393216:lsMBBgUbIJbmUpy8ONyDA3EcJ5g8cZuRjT4b0nmlsgf2ap18YYy:ltOUbQmUpzONyc3EcJ5mb0n3gf22n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638815690, "uuid": "a95ab0cc-c742-47c4-8fd8-46b3c5b1ff08", "value": 17457080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638815690, "uuid": "52204d1b-e8ea-4746-b7dc-4a3da868e501", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638815690, "uuid": "dfd532aa-da00-4a6a-b2af-64f2ad1b6d43", "value": "Sandboxie-Plus-x64-v0.9.8.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af199b4-56bb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638812242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812242, "uuid": "25178569-189d-4636-b54c-f17af155fd5d", "comment": "Malware payload (Formbook)", "value": "8a650ed066c897dbb93e29c7892d6c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812242, "uuid": "67e422c1-48f9-4a0b-a332-b751a8e22b4f", "comment": "Malware payload (Formbook)", "value": "b8c628fdb35b1082bfe51ee070939de02a265a74adc8c4b35552076cd8dde378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812242, "uuid": "07e048e0-0a2b-40d8-96a3-7abaa0ce19c2", "comment": "Malware payload (Formbook)", "value": "e7a20f4021fd2f9b1c3de2886434a8cf7c1359f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812242, "uuid": "32803b5d-10b9-4671-bb9c-84c3c91e0e66", "comment": "Malware payload (Formbook)", "value": "31bd9015f74d8e234584b332e1bdbe8d0dc3249555d3b73d04464a9105f38d6601485accd0fb77a22f7476dca161a180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812242, "uuid": "1225d2b4-2673-4723-b099-e7feec338fa3", "value": "T15F64121FA8D2C0DFC7034E7261B0EB9DD7B5859806665AC38FD8AF7B1D3299B46022D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812242, "uuid": "970b3f04-59e5-4abc-ab6e-e04786799efc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812242, "uuid": "c8244ae9-7fe7-4a92-ba28-e1d224170cd8", "value": "6144:rGi3/9+cvqrJMuEcgqAx3Vm2m1PKO3eFFba1DCgwKw5Fr+X:7/9rOMKvAxwOfe11wDFr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812242, "uuid": "5eb6fbed-891f-46d1-b3bd-60541640a226", "value": 321034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812242, "uuid": "01b54428-deda-411b-a0e4-fb38b9d36b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812242, "uuid": "c8c2b8ec-71ae-4fc2-870b-83d396c73685", "value": "8a650ed066c897dbb93e29c7892d6c30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647c513d-5681-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638787427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638787427, "uuid": "b4c5131e-8a4b-4cad-8e5b-4967346a689e", "comment": "Malware payload (AgentTesla)", "value": "a666db8779c1871f2751a4ca3085d730", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638787427, "uuid": "20ba426c-1c54-4e74-848c-2268ad0df60e", "comment": "Malware payload (AgentTesla)", "value": "b92a613876d5460c5741e02b6c17b749249339157d7cac66ff46758fcd2cc73c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638787427, "uuid": "224cf555-d3f4-42b5-bdc5-86b476ba7de0", "comment": "Malware payload (AgentTesla)", "value": "d6fe09efd32c2da04b150f9464a8916a48ef5c30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638787427, "uuid": "95ff06a3-848d-4070-9ecd-db85f02bd672", "comment": "Malware payload (AgentTesla)", "value": "3db627efce986f67150cdbf4c2da3e2d3bca35345759d60cfa2ee8ae44cad7e4f13e003422b3e158a88b9d74cf17bac9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638787427, "uuid": "84f275f6-0c41-4147-ab3e-ba306692a6d9", "value": "T1E2557A2C22B5085BE97D1A34142147374EF26D3D95BBE3CD3788356B0BB36844A267EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638787427, "uuid": "9f7bc1e5-ab15-44c5-96fd-5596b9e483d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638787427, "uuid": "15e6f18d-8305-49d7-bd9e-81f89cf5ee20", "value": "24576:GuR1IGzIeckPIc0eaOKvB0kpgjZTP/8ma+spF6hPyZtLM:Gsz6/m7KRgjl8mno6h6ZtLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638787427, "uuid": "74d69267-a1c6-4a18-af78-0750985ed1b0", "value": 1370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638787427, "uuid": "86f8201c-e697-441e-b321-dfda8e746d4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638787427, "uuid": "c8c388e2-1188-4872-bc99-38054d109a51", "value": "FUmrmsxgXKGa2La.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7e30ae-56c6-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638817162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638817162, "uuid": "a8df926f-5073-4de3-8c91-189949b36476", "comment": "Malware payload (NanoCore)", "value": "89bc334da6e4d254ca8e34e88dec9f74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638817162, "uuid": "5f0527a3-0c9b-4302-82fe-ca812c7fbe34", "comment": "Malware payload (NanoCore)", "value": "b92c62e3c9dcf204419b61697382a9b3df62aa432da1c490aa7d6b789af78712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638817162, "uuid": "85a3e829-613f-4597-8ba6-d90addb7bd91", "comment": "Malware payload (NanoCore)", "value": "55ce241ea834756f200d1e10a8914b44e3066631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638817162, "uuid": "0e2c99f7-528e-4b90-8969-06489e017bac", "comment": "Malware payload (NanoCore)", "value": "099c3cf3befb3a341bbf3f4b7ec32eefe601c9295e3b24d9a38f1c32e4c9119e6eda7457c464a64fd30a541a5987ee4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638817162, "uuid": "93ffe497-3653-4e6d-999d-289498def3f2", "value": "T137B4E15526EAD2A8F87BFBF50CB175C507B8F6D0F540E2DEFE80145AA8A2B944F40472", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638817162, "uuid": "be80251d-390a-44d7-aac5-ac7fd1068f8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638817162, "uuid": "05db3310-a184-4b1d-96e5-42f051870f9e", "value": "12288:rZhGa2iNE/xmapkW4wkMDbuTTGt30cGz0j5FjS:rfGa1op14w3uT3Fw5hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638817162, "uuid": "94356b9b-94f7-4f89-99ee-697c6c84920a", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638817162, "uuid": "930e714d-d1d8-4995-96a6-075e4087a42e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638817162, "uuid": "6f473f22-203c-4621-8a20-87f5b24e71b8", "value": "PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c3e470-56a5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638802802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802802, "uuid": "ce18cbaa-c555-4f2c-9c03-4c62ecd4c88b", "comment": "Malware payload (Dridex)", "value": "f7703084b13482c646f3851e18d8951a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802802, "uuid": "9374a544-7f08-475d-b303-28c60309ccd3", "comment": "Malware payload (Dridex)", "value": "b98be8d2e7d160dacbd6cf682aa3fa9f0a0a68ae2d0f89b25376519f0883e495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802802, "uuid": "be04d793-251f-4fe1-a439-f748dae26a77", "comment": "Malware payload (Dridex)", "value": "939ff0c3db869fa5656b6905f824fdb69050e43c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802802, "uuid": "9fa94185-2ab4-489b-88c7-a44f6be20152", "comment": "Malware payload (Dridex)", "value": "73decfcf4bed9bcdcc3fa99ee0091a580ac7ab06b5da3b73fa2e8b454ab0df11374507003a1249b31cc548fa3de5d4ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802802, "uuid": "42a075b3-f051-4699-8c64-32281ae19a67", "value": "T1E8A4AF469D16A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802802, "uuid": "9fee4be5-565c-428e-b124-1f03dbf62aa3", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802802, "uuid": "5b6cca75-35d9-4cee-a3c1-f5cd4b89a771", "value": "12288:o7fimEsIsmY4K08oM1Wd8t5KQhNdv5z0:o7aVRBn7x6jty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802802, "uuid": "89220230-9728-4279-8d74-1cb8671d799c", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802802, "uuid": "1688b4b1-a190-436f-8dc4-382661f62e31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802802, "uuid": "bb39a525-1e68-4bfb-98e5-cd740c4f698b", "value": "f7703084b13482c646f3851e18d8951a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448bc5eb-56a2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638801547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801547, "uuid": "54ff0d83-5363-4efe-af50-c155b33c0923", "comment": "Malware payload (Dridex)", "value": "5c0396c4293d8b54981a7d9827bea89f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801547, "uuid": "bc81f322-f146-4954-846c-1ff33eba8b12", "comment": "Malware payload (Dridex)", "value": "b9fc703bbe7b6eb297d7c4506e09105bd652a256f7f0a9bcc379f83c96ced325", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801547, "uuid": "35f8b83f-6710-4202-8a52-a9548658b0f0", "comment": "Malware payload (Dridex)", "value": "7c82bda4ca6acb6ebf8dffa3a34212475103fdf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801547, "uuid": "b2779a01-dc18-4b1a-9d28-6b64893c4666", "comment": "Malware payload (Dridex)", "value": "b9167f74b0d7df13be838d4303d1e718d6320262930eb495faa02522c117beb598d65f289d96f1d4d19b6bbd1afde6f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801547, "uuid": "5fececd9-8f1e-456d-b1f0-9bf90a8a2165", "value": "T1F0A49F7CECEBB436C411C7F0987793990D352619E3FFE6E0362B9087A75A6600A4589F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801547, "uuid": "87692e3f-0f22-46f5-a9fa-f5bee712c333", "value": "5293be9dcc3fe4423188dd90c7dd2d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801547, "uuid": "57ee1e4f-f669-4734-a44e-c0b2e537bacb", "value": "12288:mQG80io88EmEkECG2EGoyEW+DBY49h4oJIH7lb:7G80io88EmEkECG2EGoyEW++HKylb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638801547, "uuid": "17193b34-c6fd-47f5-88b5-b906c320dda7", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638801547, "uuid": "fc24071e-b597-4b38-b5c0-ef39f6fea7ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801547, "uuid": "11795566-2c31-4577-8665-8f55f3f662e5", "value": "5c0396c4293d8b54981a7d9827bea89f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dee758-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638765045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765045, "uuid": "94402323-6736-4106-9dd3-3c92892ca8d2", "comment": "Malware payload (Smoke Loader)", "value": "b83986f5ac860d00413c041db29d8e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765045, "uuid": "10dee9c6-793d-485d-8c76-e03cac8fd04c", "comment": "Malware payload (Smoke Loader)", "value": "ba14d67497a2eb70d97059d6ab756de7d1e5502b6a2325998541fa80397c071d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765045, "uuid": "d30ef60e-770f-4b50-af36-ed2726a93ba0", "comment": "Malware payload (Smoke Loader)", "value": "9f6430d70cc84222bf8e3d7b8e1500b2de36b913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765045, "uuid": "ffd1ae54-7dcb-46f2-a41e-6a3fb295871e", "comment": "Malware payload (Smoke Loader)", "value": "e8bc3430d2fccc8a14bae541aa3299b1d308b5a49cf1cfe8d55e7666e9f1b31243af12d5a18b6eb4530f25e001e01e4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765045, "uuid": "853ed7e3-7bd9-4934-b805-8dd17538df64", "value": "T1F6549D2133D0C432D59729368525CBB58E7AB4712A666ACBFFC42FB89F247C1973530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765045, "uuid": "c3c4e561-fa9a-419b-a7a9-4c851a3b7d0f", "value": "6c355763d97257cce28120024c0d5f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765045, "uuid": "06218c45-cd12-4a1b-be5d-7cee5694a1b6", "value": "3072:+J9JAasjGN1zIyKZgui9ZFoJiz+iKghFOhrDVQZIu3vsMQHMj5fer:wHADGTUdmZZ/hFADV7u3EHM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765045, "uuid": "9eb216b7-fe42-4a5d-b20e-c8d7d751855d", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765045, "uuid": "663a6ac9-167d-45c1-b64b-96d4e3b8fc90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765045, "uuid": "b68a94b1-7f98-4261-95b7-d00705f0635d", "value": "SecuriteInfo.com.Trojan.DownLoader44.11112.3650.19333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db53bd4-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638773189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773189, "uuid": "7652ed0f-51d2-4946-b529-c8bb597b92e6", "comment": "Malware payload (Vjw0rm)", "value": "1fa10808ee55f1de160b3628fde35526", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773189, "uuid": "8cb1c912-1bfa-4199-b6b5-961f45b1eb8c", "comment": "Malware payload (Vjw0rm)", "value": "ba43508418c1890886dd6c68e7dc0d0a8291c147c3919147d0ba89b29e427566", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773189, "uuid": "84a5a541-62cd-4f47-9a76-1ca265ed0689", "comment": "Malware payload (Vjw0rm)", "value": "5422d9396f3b782fc88dfba492a51560a9e98275", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773189, "uuid": "0e24e19f-5948-4ac0-ba8b-d5d3dba1076f", "comment": "Malware payload (Vjw0rm)", "value": "530d4dc0f61bb3c8ccb9c7ff9609e84604e4e6746c5a76a7a784d4384e881722c5aa6b1dca9633ed70c91d034650e109", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773189, "uuid": "7af4a31a-dbef-4465-a4db-c891417d2a01", "value": "T1EF544A886982B6D8E710F078317A68DA3BD0228FD0846BDB759DF7015FAB754C3CA674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773189, "uuid": "7b36c669-8d93-4476-ab42-30b105b64528", "value": "6144:8+D/SuouB1HIxTJAEtZGWp6mbs8b5SFDg:hSuoK1HiFTT6Ov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773189, "uuid": "2d0a0100-5820-4446-8387-fe2b3be8419a", "value": 278875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773189, "uuid": "511d1139-577e-4937-a635-946c99bf2c30", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773189, "uuid": "dec04780-321e-44b6-9828-4738a93fb13b", "value": "2021_11_17_AB2106159.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ea228e-5685-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638789205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789205, "uuid": "9f1ae859-b7d4-4476-afcd-f833be148a23", "comment": "Malware payload (Heodo)", "value": "707a4c2a44c9edda39af6a4a4fa1bf83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789205, "uuid": "486d3c54-b4a8-4f95-a278-e3e4bb4e8b7d", "comment": "Malware payload (Heodo)", "value": "bb0fa33eabc5aecd31d2d9dc7e7430020d09874aaedb9b9d61604e07cdfe0d10", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789205, "uuid": "c11c3377-0283-4217-bb95-00642d55eb24", "comment": "Malware payload (Heodo)", "value": "d2fde803f55ab0f1b862572e9e21e355c1baa4a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789205, "uuid": "21b1b96b-d344-44e8-87f4-fb9a4c11e7b7", "comment": "Malware payload (Heodo)", "value": "786444890dd06faec757b3d2f61ab542a496789e03f99fe243fe9f0b13a77755a7ff204d2fe05da1d2bede57464717d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789205, "uuid": "4462353b-996f-4cbd-92d5-70580a9acc60", "value": "T114F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789205, "uuid": "f1c319e1-9199-46a7-b1b2-d71e3592759d", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789205, "uuid": "73b38627-2577-42bc-bd34-7e73d49b1dff", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/4:JapiKiBEmj4GbOX399Md9J/0Ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789205, "uuid": "a0c785bc-256d-413d-8b67-b6793b19ca24", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789205, "uuid": "1e9e52c4-692b-4720-abb8-2e7939b8bac3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789205, "uuid": "5550b19d-ce0c-4473-928b-b6039ae664b2", "value": "emotet_exe_e5_bb0fa33eabc5aecd31d2d9dc7e7430020d09874aaedb9b9d61604e07cdfe0d10_2021-12-06__111320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a90402-56d6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638824037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638824037, "uuid": "11fc25a1-edb1-40b8-970e-5b0f1315f0d3", "comment": "Malware payload (Dridex)", "value": "53b7dfea4f16dc18640e9819559373f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638824037, "uuid": "0a6b31ed-2440-438b-ac82-895421344dcb", "comment": "Malware payload (Dridex)", "value": "bb26c9f976e5cd4a63cc57453d42eeffa93c9522074eaa20042ea1eb9c7a1100", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638824037, "uuid": "bd7a329c-9b9d-4a68-bbb2-01baa7109098", "comment": "Malware payload (Dridex)", "value": "1f844d912d1662e9eecf84e76bec1c0c46c06ec9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638824037, "uuid": "3ead2e06-ca7c-4e70-a5a1-5a23b2968f43", "comment": "Malware payload (Dridex)", "value": "57213c5f9b6f41113c13368842fec8e74e44d57ed2d7f942bbf14e6dc101c2a11f926776ae3b8d779fdf7cbf7646c7a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638824037, "uuid": "ff1e9b74-d9ee-402b-ba2d-3d6dcde53b7b", "value": "T159A4BF4FEEF690B5FA32F8B134528292E1CB9C752002B7D485616A58FCE5C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638824037, "uuid": "46eebadf-6ca5-4f06-a2a5-d5ea6f5fc4ab", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638824037, "uuid": "87f09bd5-bb22-4ba7-81be-4eabea6e8b71", "value": "12288:CCfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWRs:CCfzehtApz4lzQvzU3H2Jz+BbAt3A1NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638824037, "uuid": "985eb36a-7284-4bed-b4cc-75f9a6585298", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638824037, "uuid": "933dd59d-92ff-4fc8-8311-cee383a9dd84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638824037, "uuid": "543084f1-0bad-4f6c-bf60-d67076168f2a", "value": "53b7dfea4f16dc18640e9819559373f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e99e5ce-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760386, "uuid": "12737389-2000-42eb-af4f-0d3a15e44c67", "comment": "Malware payload (CoinMiner)", "value": "0931d1e2a1cadf4cec1d8304d8eb9353", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760386, "uuid": "c2fb21ce-db23-4b0a-9e2e-d16e800514bb", "comment": "Malware payload (CoinMiner)", "value": "bc5109f4f14f58b650812998ac47dbe37ec23bcfa7de6d14029fe6b7ed3d961f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760386, "uuid": "85aa4463-87f7-4cca-8005-fbdccd5f6b2d", "comment": "Malware payload (CoinMiner)", "value": "6b7afe7d4cfabd387aaea1aedd7181cbc5c2bd32", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760386, "uuid": "4ada561f-cfdc-4ac9-b862-72891997a7d3", "comment": "Malware payload (CoinMiner)", "value": "2efc1627691a92837afa9e248e15e5640112f1f0322cd9586f9f47c06dd943cca819660682c5032571df87baa2d3004b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760386, "uuid": "1d9ae9ce-940d-4517-8d3b-4c9d2f3a854b", "value": "T1CBC53321DDAB6EB6C77C9239717B2F4727E00F11104CFDE683F5A98B228B754092B51A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760386, "uuid": "752c6806-8944-4af2-b3a2-c4a0db1c3289", "value": "9bfd2dac39af50555ae9789117b36b66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760386, "uuid": "c6358435-8169-4a42-a418-b73179e78080", "value": "49152:SAdYUn9e3+9oRCKECV3GsyTyn5sO5oKD:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760386, "uuid": "7d66f3b6-ac37-4653-adcd-66f2d349d8dc", "value": 2681344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760386, "uuid": "268f998d-abb5-4d4a-89cf-ada28a47d048", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760386, "uuid": "e3d4abbb-32ad-4d6d-ac42-efce8a563141", "value": "SecuriteInfo.com.Trojan.MulDrop19.9268.22706.10576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19b0275-5690-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638794053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794053, "uuid": "b97372a1-ad06-4e17-89eb-f6a2e839bc12", "comment": "Malware payload (Formbook)", "value": "caaa3f1ecbb403120ffd130500a29f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794053, "uuid": "bc392228-64a7-47f3-b041-fd9fb15b7382", "comment": "Malware payload (Formbook)", "value": "bd226a9a2ca1733959a195b2b808bf9183ce5aebdb730afdb31a62ff42817a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794053, "uuid": "864093fe-4f07-49ae-9261-32e5af0b83db", "comment": "Malware payload (Formbook)", "value": "682c0800a1b99640c5e5c1f24848c978f8be61fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794053, "uuid": "754c0804-a45f-4ee2-ae12-b0a3e236ef0a", "comment": "Malware payload (Formbook)", "value": "f8a2c7c18639cab834d3e333dabc90ce167b7f151c7e853fe615464c2eae204665109f8611f6721ef315f5b922a37f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794053, "uuid": "85c31844-56b5-4a15-91be-0f85ae0ba56f", "value": "T1EE64238EABC0CDCBD1161D323BF6CFB59FB782651082A81B07C85EF91951092CE567B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794053, "uuid": "586456d7-1498-4eb7-bffc-f907657e7b2a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794053, "uuid": "9c4822cf-5165-4286-8e22-cd837fdc18ea", "value": "6144:rGi+E7wb4kiq46h1tqK5KGCb6+PLAWPMNoc45Poo7xtHb:SE7w0klXh1bY73gCoYfHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638794053, "uuid": "41a4daac-4567-497a-a4c8-51dec0b06ce3", "value": 320990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638794053, "uuid": "ae85faf9-b940-4837-8998-798ac48d1567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794053, "uuid": "c0292633-101c-4807-b18b-f4c00e481c0b", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f990f4-56d6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638823932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823932, "uuid": "500db327-7a60-4010-9587-2378ca96ad67", "comment": "Malware payload", "value": "d5b9cb4214fd9487006287c30f8dab9a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823932, "uuid": "96d27ff4-a658-476a-9dc5-ceacc2aedb27", "comment": "Malware payload", "value": "bd71f5a34b4810daa3a9ca12dc6a86e464f58b7de454fe16e3c35b5a807ad766", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823932, "uuid": "8a8a86f8-300d-4514-874c-bc8fa1d566ab", "comment": "Malware payload", "value": "b70483973a89ec687aa8242bcd42f6a9c02fef8b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638823932, "uuid": "1988de34-7334-465f-91a4-cf62a6943f3e", "comment": "Malware payload", "value": "2fa78673e6db557d0345d314aceb359ad8faddd4cca9c7e5e9252723ed2605d757454febb6f81b6fddbcc8bf51b20269", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823932, "uuid": "74ac8e81-40d2-4892-ae76-3c5d542a658a", "value": "T1D753020B5D268E7FF9C007BF0015DD9904A290BCA9E5CDCAE53D80D298335C8ADBE996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823932, "uuid": "33020d04-bd79-4f5e-b3ae-b8b35f2327cc", "value": "768:Ppb/yOnIT2+5sFruqJeS+8emWGAbVaxGMRXZO+bGv0A8obNsufEC9ZFdTcpbRZBz:k+g+fF+8etb5yXJpXWNsu1ZFdcX/Em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638823932, "uuid": "dce4ea64-accb-4d88-bf43-1fd4e0d5a0f7", "value": 62102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638823932, "uuid": "ee9a38ad-7fbc-44e0-ae3f-de262b0c2976", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638823932, "uuid": "04d4f65f-79ff-4fc2-a188-57043ae2914e", "value": "asperioresvoluptas-10357326.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43360e29-566e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779211, "uuid": "7f983c39-74c6-4147-b822-857e08280a91", "comment": "Malware payload (Mirai)", "value": "f6d71581f821128574161a332fe24b8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779211, "uuid": "447a0dc6-b105-45d3-a4c6-eacdeab1cf1e", "comment": "Malware payload (Mirai)", "value": "bea38feee5ad18d98c2e9dc39f4cfb22d1d66832684e9b4ad5fc842cd39c949e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779211, "uuid": "ae8f3d1a-c553-4053-a192-a495c6bd40b4", "comment": "Malware payload (Mirai)", "value": "47f43f56dc2eeff06516603a14cc855f08dcf974", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779211, "uuid": "0a2a848b-f600-473b-8660-8a523a7b4f24", "comment": "Malware payload (Mirai)", "value": "d64ece69781f638fa9a09ca9ce4e1363149c384a1927dbbf44c73bf63db959566978d2f80870a548182fc95e7422c2ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779211, "uuid": "177923c4-c2cd-48fe-863c-ab4051303036", "value": "T17AE37D63AE974827D0A8723E42FB8334F0D32B0874389F5E7D530D49AB387956A67365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779211, "uuid": "cd184048-8efc-4319-a3b0-e07ba9231f79", "value": "3072:DF1S2TDhOSx0jzWkWjlDIUo/707a4zouasSJtrTtfrlgNvHy6gwupHNPEjmzgvTP:HkWjlDIUo/707lzouasSJtrTtfrlKvyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779211, "uuid": "ef92c265-d79c-4be4-9ec4-56b3d4dd00b2", "value": 152608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779211, "uuid": "d895f1a0-c875-4814-95b9-ed5337660806", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779211, "uuid": "249d8b3e-aba2-4f51-a7b6-98e56cd2bcf1", "value": "f6d71581f821128574161a332fe24b8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32f346b-5659-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638770460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638770460, "uuid": "9bb2f1ca-e7bf-41a4-bee3-1808e68ea51a", "comment": "Malware payload (RedLineStealer)", "value": "50c33ae0c73c2a4d5de139face8bb0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638770460, "uuid": "56aabe25-58f3-47ef-9026-dc98c18b09be", "comment": "Malware payload (RedLineStealer)", "value": "bec84374ec69284617428819047e712e66452381442e679d8b882b2db41ffbce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638770460, "uuid": "bb3be05c-f989-43eb-9562-142fca033944", "comment": "Malware payload (RedLineStealer)", "value": "d8bdea7109cfa833926ed5a70dace74077900bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638770460, "uuid": "00ca3dc5-637b-4936-9284-a0421768b992", "comment": "Malware payload (RedLineStealer)", "value": "bfdfe8581efed9ca9ea8a0cb7c63fc848dc5a533654d765ba65f63f1270936fb965b17979dff8b26de2fccbeae846131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638770460, "uuid": "c54c75b5-f725-4a79-8e3b-0c7e3157d45d", "value": "T1AF549E2233D0C432C59725768925CBB54E7BB4712A666ACBFBC41EBC9F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638770460, "uuid": "6cf19f2a-5c54-426a-bcb1-b511e61d5ac0", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638770460, "uuid": "0205ad66-338d-4204-b4d3-0763e72aee58", "value": "3072:eMdZzCNSgNh/y7Kwgu39ZF2JiI1vKgTsVK7DVzRRpmGEuaH7pNQHpj5fjhH:V7zmxGuaZElTsoDVPg7pKH/VH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638770460, "uuid": "00a6db57-c8a4-440a-8892-09b10e8412d2", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638770460, "uuid": "9a27eece-bcd7-4b96-88bc-36be87de5eeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638770460, "uuid": "0fcb2e4d-80d6-424f-af5c-8c4c41c75ec8", "value": "50c33ae0c73c2a4d5de139face8bb0d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaca566-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638765131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765131, "uuid": "3f67b963-1d01-48e0-8468-58a49e02d18c", "comment": "Malware payload (CryptBot)", "value": "53761bd3f6683b5266df132b5a47b665", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765131, "uuid": "61244411-71a6-459f-afd9-cecf742a5d24", "comment": "Malware payload (CryptBot)", "value": "bf2a6a6a3ace1fc56eb98fd190c5ddf9835c26f18aa88426c86e575cfa8f0a92", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765131, "uuid": "782e66ee-226d-4cd2-9d0a-371accdeb1ed", "comment": "Malware payload (CryptBot)", "value": "c8fb870e75e9d0d6b06a9e81f35f8a816c006b63", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765131, "uuid": "1fc33f8d-440a-4210-8b5b-858a99e57dbc", "comment": "Malware payload (CryptBot)", "value": "7a67c9f5a0d049ec34ffa46bc5f28295c2f0dfbf3704331ef13c5633c1d38a361cd911d1f9cf5e7d617cec8036d13b3e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765131, "uuid": "08159a6f-64e3-4765-aa4d-2e074ff26ef4", "value": "T1AC84DF1172D0C032C096A8768C25C7B15E7AB4711AA66ACBBFD85FBD0F647D2573A30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765131, "uuid": "74801949-dcbf-475f-a248-2f343b55da3e", "value": "6c355763d97257cce28120024c0d5f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765131, "uuid": "af5f2ca8-8525-4b10-81c9-6889fc7d7861", "value": "6144:47Y7gDJ2njKDfsbp8qx/j+BFmoP6tSjlVGtQBwz5Tmc:47Y7n8fslTiBwoP6tSymBwF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765131, "uuid": "98f48838-26f0-4a35-af57-e969329a61ee", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765131, "uuid": "4b76840d-ca31-402c-ae0b-1468133cdd88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765131, "uuid": "533e5220-f85a-4142-876b-503edded7e5f", "value": "SecuriteInfo.com.Trojan.DownLoader44.11056.30858.20072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f5c0ac-5686-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638789745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789745, "uuid": "6d3940ad-77a7-4dba-bc66-14e42da617a2", "comment": "Malware payload (Formbook)", "value": "d40c8ccf0f7b69ddc3924a0252d6028f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789745, "uuid": "56d7f49a-46d1-45ab-8d5a-702e4605b900", "comment": "Malware payload (Formbook)", "value": "bff57a8fb15fa2fa232b93325d3ddae41ac6873da1660af16be6c47d1ee17904", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789745, "uuid": "89d04913-4cc7-470e-804a-b598d0f0b636", "comment": "Malware payload (Formbook)", "value": "74eff67f4eccb89a403ab15fccdfe1a8a649583d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789745, "uuid": "39459734-6558-476f-9a51-8164ec502013", "comment": "Malware payload (Formbook)", "value": "050f9bd8d96763c80a399fc368adeaa714e21e2a43fa54838128f4967dafa8951075781fa080617c2822ed5aa4acdccc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789745, "uuid": "9b474791-d09e-415e-9d85-0e7df4757c40", "value": "T1493412287A2966DCC2FA4AF8F0249B4DC214BE34CB1B2D3D5B18355FB9F18694D9138D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789745, "uuid": "eaf3363a-40ed-45bc-9769-72d722e39d84", "value": "6144:M9aMliuScq/Zpr0ZPZ3JGcMM/rl4yw9N4fir:8Z4u1PZwMzGyw9N+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789745, "uuid": "6ad976af-49c7-4cf4-b7b7-a69d98df1ca6", "value": 234872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789745, "uuid": "a96c5589-22de-4482-a873-27d85c6833f2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789745, "uuid": "6e50ec7b-81d8-4f72-a0eb-5cb9d34eab00", "value": "REMITTANCE ADVICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d2ff75-56ae-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638806695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806695, "uuid": "c7420b2e-e7f2-4795-8690-bbfe2ce0e450", "comment": "Malware payload (AsyncRAT)", "value": "3ea9acaceb901b3b5c8789db1eac745a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806695, "uuid": "631302b9-7090-4c94-981d-dd8d7776dd0d", "comment": "Malware payload (AsyncRAT)", "value": "c07aff77a2523b0fa86790e3dab7341e75fa557cdcb7f850b5cc803f6260cf88", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806695, "uuid": "b8034963-d888-4c97-b5c1-6be7f06aa1c5", "comment": "Malware payload (AsyncRAT)", "value": "ef04d6ca2cd45fc940bec7c44ff4e158f6e8d129", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638806695, "uuid": "cd177942-29a1-4ce8-b1ef-fa8fbada94b8", "comment": "Malware payload (AsyncRAT)", "value": "1d351182760dbb99f5ba1b6fb75cbf710617622cc1d739d62de6e6f87a659d84f5cbe85e1039dc1a3fd40a3a62c386dc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806695, "uuid": "1a6dbafd-76d1-436c-8e5e-168f736d847f", "value": "T15A9438342DEA502AB173EF698BE479EADA2FB7733B07585D10A103864B23942DDC153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806695, "uuid": "4452fa95-8076-4fb9-907a-e2bc977a0ef7", "value": "12288:kA8riLTl+bd8DcYvZeSdenUK0D/JGPNaeHZSFtkWWPq:VFJ0cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638806695, "uuid": "3bde90ac-5651-4807-af65-5b7dad25c5a8", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638806695, "uuid": "61e9a220-d83d-408a-b301-d919b1ea0c8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638806695, "uuid": "1fa0da33-924f-4c0c-b74d-384eec5a74c1", "value": "3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d304859-565e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638772275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772275, "uuid": "5c36706e-a635-4643-9166-a3597c258a7c", "comment": "Malware payload (Loki)", "value": "dd939aae349dc2b9add3f26114da4a73", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772275, "uuid": "f4a67c08-b9c9-4e38-b83e-7b8e638dc4cd", "comment": "Malware payload (Loki)", "value": "c2a82bda3c388a3797d84e1078b1b66ee74430aa4f26afb46cd190f2fc8b68ab", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772275, "uuid": "2a767a43-d29f-41c7-a4c8-53793eca9399", "comment": "Malware payload (Loki)", "value": "160a127eecd37636c220f5c149913259d017717a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772275, "uuid": "ae24d343-5da6-41bd-b2be-aca139082601", "comment": "Malware payload (Loki)", "value": "f95943b1722cdcbf5cd8247ee9126dc20bfe6e31951df170b9fde1ddbdc8c769921e43e0943ae024a7776d6dde2018d5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772275, "uuid": "3686b990-25a6-4aba-b29f-52b07303c3ba", "value": "T13334129020BDFCF8EDEF56B1B5A058061637DD67A93CB9B46CBC363C51357A284E2428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772275, "uuid": "0b9dd90f-f505-4b66-98f9-555e6e535bb9", "value": "6144:OfCmZljeRq451y7sTaKnwOuOVgNaojv6P05:Axviq4507xkwO58ase0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772275, "uuid": "ef9b225d-2a6a-4153-85e5-906b92fff68b", "value": 234600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772275, "uuid": "c2e259a3-de20-41c0-8893-56ad98ddc15d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772275, "uuid": "9412e861-d9ca-48ca-9689-584eac9911f1", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda99394-5661-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638773887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773887, "uuid": "5af61d4a-d88b-47de-9f07-87e32040715a", "comment": "Malware payload", "value": "4c842c4e5d2be99f9b9a154369ce6cf3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773887, "uuid": "a810b269-5d25-4282-9718-cceb7cdfe67c", "comment": "Malware payload", "value": "c468822f19f01d2f31b8c4ff455bc0727943a6adb115283049a64d6028cdde8c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773887, "uuid": "0955faa9-59cc-426d-b9b3-1381ad2ad009", "comment": "Malware payload", "value": "24308f7bdd71de44693b46386512164f4f443872", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773887, "uuid": "16449701-a321-4425-a6fa-abb985fe4312", "comment": "Malware payload", "value": "86e6985113d5bb8592690e0c044be19b168a3d94f8d86dde3c79f3efdc8d0f04d650bbb960946d03c428b188b5bc57eb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773887, "uuid": "eeaa8090-4455-4c8b-8e85-855a40f4a877", "value": "T15CE12B2E5933049AC35F247B8C8810A08B39F566564B074B3B74E3292EF69E713DD25F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773887, "uuid": "c5a815b0-342b-404c-ab72-0faf7f4ac40b", "value": "96:cAn9gmyKtnTjdwAiMhVVCvkwQEeGIRf3UNaa82ZUv1DZPpoBBeCpHYuL9pEgFLUV:7nrzTBw5OV8vdQjmIv1ZmeCNYujdkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773887, "uuid": "e661bd93-cddd-4863-973e-df5a43a23aff", "value": 7144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773887, "uuid": "56157eb9-9d0b-40a5-b6c3-2dd1f1c35ff8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773887, "uuid": "92924c32-9850-4c8c-a301-bc34223b665e", "value": "PO # 211112.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9419a67-56b1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638808185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808185, "uuid": "492cf034-d72b-4e7e-bfc9-e433003c8c7f", "comment": "Malware payload (Dridex)", "value": "3b5c90c7cb249e07f6b424dbceb0b633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808185, "uuid": "ab9234e0-22e3-4665-87e0-97b8c0ac055f", "comment": "Malware payload (Dridex)", "value": "c4b4cff7a59ccfa3a72a64fca76c946f81007ee310d623854f38d2fef2a2fb66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808185, "uuid": "dd2191c5-bdcd-4432-99a4-ad58e0655613", "comment": "Malware payload (Dridex)", "value": "9171f634118468238b077faa104caee345581709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808185, "uuid": "f7297ebd-2885-421a-8647-f1edbf972093", "comment": "Malware payload (Dridex)", "value": "be97a7cc75a790274bf6e6384a0be0dcb232da440918e68ed54a14ed6c0b36944a69b1b642078a8abb7e993ccddca532", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808185, "uuid": "2df302b1-4a16-4345-b6a4-1f2f34f961fa", "value": "T155A4BF4FEEF690B5FA32F8B134528292E1CB9C752002B7D485616A58FCE4C7F648D8C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808185, "uuid": "3a355f2c-d4cc-49dd-b463-e2a61e018d2d", "value": "aa6cc8ff2bfdc2453ad6946bef320766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808185, "uuid": "551b0574-2344-4a82-a41c-72a970fb63c6", "value": "12288:ICfzehtApz4lzQvzU3H2Jz+BbAt3A1NkpzBTf/o1VlkOZVjWRQ:ICfzehtApz4lzQvzU3H2Jz+BbAt3A1NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638808185, "uuid": "af96aab4-5345-45ef-8b23-d7b4db453607", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638808185, "uuid": "100d1121-4967-476c-b62d-efb541998b6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808185, "uuid": "b73ea2f2-281d-495e-b8e9-5abbea0cc7fe", "value": "3b5c90c7cb249e07f6b424dbceb0b633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde7cdd9-5692-11ec-96a4-42010a9c0029", "comment": "Malware payload (Lucifer)", "timestamp": 1638794986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794986, "uuid": "102f53e2-6eab-4486-8ede-81db031e5c20", "comment": "Malware payload (Lucifer)", "value": "36368c9fd1e1a36e36b4f3138041c284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794986, "uuid": "c51db731-4a2a-4a02-9b7e-ac0e3f0efa9b", "comment": "Malware payload (Lucifer)", "value": "c4e7f9976fa37c7489423ab3c576c4d273f5a53e922e62073fa2fc143a6c65a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794986, "uuid": "3348eaca-6c16-4bab-9101-d6c73522e82f", "comment": "Malware payload (Lucifer)", "value": "e0dc337ef5f736923844788f08cccea3419af8b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794986, "uuid": "f92c7c65-bdda-426d-93a5-5c8f9182edfd", "comment": "Malware payload (Lucifer)", "value": "1826f3a8eb459ecde74957e97acaa441f2ee395b44e6795a5f82a741fc9db691d48998c10d2448f0e4a3fb6e2876a27f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794986, "uuid": "d4b2c09f-1f86-4e9f-b72c-d46e00c6712f", "value": "T181623A85FBD48A17D9BE49FB8C3356048775FA5B9802DF5D29CD60DA6C137808F00BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794986, "uuid": "0c03c93a-e8b5-40c9-851f-abbbe715f6d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794986, "uuid": "912905ed-7fb9-4062-8463-ff31c96b15e0", "value": "192:ib82pkZR70ZuStKXjN70dc8Q7MkY5vS8p5xV6KWLXSr1R1KImD:iQ2pk0Z6Ti2akYc8FQ3XSpvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638794986, "uuid": "eb530304-39e8-4301-aceb-971c6c9e3496", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638794986, "uuid": "90902fd1-067f-404b-a277-2484af9a9ebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794986, "uuid": "bba061a0-303a-4834-9c64-1e58d2defcf6", "value": "36368c9fd1e1a36e36b4f3138041c284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e957a56d-56ca-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638819003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819003, "uuid": "e69b855c-b390-4525-b808-5e62def18f9f", "comment": "Malware payload (Dridex)", "value": "f0c0419067521dc33bda514a4c8252e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819003, "uuid": "7eac184d-aec0-4058-8789-4abba04b66d5", "comment": "Malware payload (Dridex)", "value": "c60b66589bdc1025723f31d25a46f0f4e402ba7716420eca47e1d954f3b1d331", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819003, "uuid": "ddcf8bfc-c4b4-49ab-a0d0-432d82b65d34", "comment": "Malware payload (Dridex)", "value": "64728743138d7bab04b6d21766c4a1a5b27facb9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819003, "uuid": "038a74ae-ad77-4c9d-8a6d-d677d2326ca4", "comment": "Malware payload (Dridex)", "value": "0102e2f67acee24954bd483dbbc1facf000ef84546d1bd4ccb6f92af3042735d8294830dc00818966766968dd3a34973", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819003, "uuid": "4b3e499d-d5cd-46bf-91d1-ca0a6442f361", "value": "T124B3125FD2C6AD18C09368FE430E14F6B4AA45700A89A3A76224AD7CD77C9178FEF815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819003, "uuid": "3ef8a1fd-e2a8-4f57-aae0-83f488068276", "value": "3072:oC8DKCZf5FTOB1SR4CH2URwHZ1KlZQdSa:oC8DK0zTOB9CH2Ey0lZQdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638819003, "uuid": "2379852b-4a0b-4f7d-b2fb-3c0464df35db", "value": 108058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638819003, "uuid": "4ef88cdc-835d-444a-adb4-dcbfcdcb8401", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819003, "uuid": "eda5f8f9-1623-476f-bea0-ee30538bfde0", "value": "act changes-31086775.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89508afd-564a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638763867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763867, "uuid": "cb3b9fc4-a6d8-4c14-8703-d09035a53973", "comment": "Malware payload (RedLineStealer)", "value": "723a41f7ab3e9c3561fca83e1f4f3c7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763867, "uuid": "069debb5-340e-4400-8663-2d45684343bb", "comment": "Malware payload (RedLineStealer)", "value": "c62d71d8d8394949fe7d834f4026833b06dfb6b3c06c54fd1014e1fc13428726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763867, "uuid": "6bd07625-24de-46b9-8c93-48f049e280b1", "comment": "Malware payload (RedLineStealer)", "value": "d77d5594259a78fea484c1d482dd62f97fc376cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763867, "uuid": "5ea2d3fc-c83b-4002-9035-85bbf5f1b04c", "comment": "Malware payload (RedLineStealer)", "value": "b7d139fbaac29141e5b7e90ef7fd40748485937624d59e67158d4a32461d759a0617dc7eea32045fdd88c26dbba6d0e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763867, "uuid": "8ea62541-504b-4a3a-8ace-dd7e10c60f1c", "value": "T1D4352251F78A5FB9F826807BE86A8902275138CFD1E1576B206F751A2CA334314F3D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763867, "uuid": "e55f94be-5071-48aa-841e-cce31be74575", "value": "cccd4bf4fb76b9c23b74fa654df5e80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763867, "uuid": "9cb768b5-b031-4587-8f12-9b320c1009ab", "value": "24576:ZMKfdAU16jQXZa7IYsBRSGhTlBU+4yOMsN/LKv+5aoXj4pwH5dl:ZB6cJa7HeBq9fLgw7HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638763867, "uuid": "6d4b603e-380f-4a55-baaf-e4f9e2e9e917", "value": 1085792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638763867, "uuid": "025c893e-3cd2-42a4-9296-9c7c2c6c7c93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763867, "uuid": "12a3abd4-579e-4483-8283-4826bff4052f", "value": "c62d71d8d8394949fe7d834f4026833b06dfb6b3c06c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96007771-56ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638805979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805979, "uuid": "7557e828-4405-4d73-8ac1-2c8fc8a66495", "comment": "Malware payload (SnakeKeylogger)", "value": "e328fd1e861c6f3dbb5028d3f6dfbf30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805979, "uuid": "97fea20f-dfd2-4b66-8948-39317e85e23e", "comment": "Malware payload (SnakeKeylogger)", "value": "c660d6a834aa41d44968e788436c795767f7480b92eae198f4dc2306c69e113b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805979, "uuid": "3c21f7e2-565e-4ed6-a4de-d4097922db05", "comment": "Malware payload (SnakeKeylogger)", "value": "46de60266b3d2a1cd2ef5a3c7b9c5fc8a4b087f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805979, "uuid": "b68a5080-5e5d-42a8-b847-5627a1ea6584", "comment": "Malware payload (SnakeKeylogger)", "value": "117f6131ce6b50c6650128e0bff317671be2271209a9f1c1e04da197943e43ab463af8b01f35c8fd54de79846d7df02a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805979, "uuid": "734ce216-1005-400b-8588-7f338c608923", "value": "T182555A5C313025AFE83A853145541F7B9EF11C7D866B53CE731730AB8ABE9828F252E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805979, "uuid": "e1537751-eb0e-4d93-af51-3b7b77f0ff0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805979, "uuid": "f22fbcf4-286a-46f0-9a8d-ffc41e6f6622", "value": "24576:JaL3hFwpsG17AZsY+j+gIdpLZL2+UN8yXNjYry:MLYAZs1IdptLYhury", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638805979, "uuid": "02912388-8a59-485d-87a1-bfd8ebe57392", "value": 1300480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638805979, "uuid": "b6269485-5ad1-4517-a876-73a805ca4994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805979, "uuid": "3f1361b4-b93a-4afe-bcd1-29d58124d945", "value": "PO#4801_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef769fc2-5648-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638763179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763179, "uuid": "7795c987-b284-4a14-b444-ddd72bb4035f", "comment": "Malware payload (AgentTesla)", "value": "7f240b751bc93fc7944e1502aa412182", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763179, "uuid": "3ab2542b-a039-4089-8ec3-e1e04e8d9289", "comment": "Malware payload (AgentTesla)", "value": "c6f9c4cba68de103d4588a02b0bcc98349f6c1154600aad6422fb3aa200a45d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763179, "uuid": "62a63093-ab15-40ad-b46d-5905e544a494", "comment": "Malware payload (AgentTesla)", "value": "9453b7d865ba04f3e0ade22b8513ab1259ac2141", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638763179, "uuid": "41b9d142-cfa1-4bfd-847f-99d69c41cef5", "comment": "Malware payload (AgentTesla)", "value": "b0dce856e5e1fa8ee919ed2074351f56ee8b6591d3b16c8b70d7108ddd2610e8696b79b3b2ad9239baeeb3da60e5ecc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763179, "uuid": "66d55729-af05-4c10-8276-4605af31897b", "value": "T11D35AD76FA9D2DC0D6A8463BC4C1E87042B6ECA5D108E83B6ED43DCF25F5AD805699C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763179, "uuid": "45dbcc5d-d995-4ffb-a4a0-d8cfab4da644", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763179, "uuid": "68911eae-75e5-4600-a5bc-f176bb791e66", "value": "24576:6sTq06BxdHdElaXBK5tjNzZRcLHDMMkV+IbPzEkcMMMMMMMMMMMMMMMMMMMMMMMp:6NBKlaRKlzZyqzEkcMMMMMMMMMMMMMMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638763179, "uuid": "8c93f435-0519-4db9-b095-b18f23608504", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638763179, "uuid": "022b3c95-b604-44b3-aefb-8ca1beaa8864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638763179, "uuid": "bac2243b-acc7-4e40-ac24-c6c67cd3ace0", "value": "USD & EUR BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ed47f3-5693-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638795159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795159, "uuid": "2a82171d-df05-4297-9236-b02f30b78a28", "comment": "Malware payload (AgentTesla)", "value": "7fd1c94e6b70874db58abdc6150d5cd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795159, "uuid": "e8557c87-d9db-4f0e-8951-14824d1acf5d", "comment": "Malware payload (AgentTesla)", "value": "c7631405c39bd36c82e9a6489fc172a366d6bdd15b461eda2ca1979b817cb839", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795159, "uuid": "d3247446-9d01-4845-ab30-aec492fda4be", "comment": "Malware payload (AgentTesla)", "value": "01ca6a02fa3bc0547b2556d0da5e1bd008361463", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795159, "uuid": "72abc45f-39ff-4b92-b151-586d2aed7141", "comment": "Malware payload (AgentTesla)", "value": "c60dd2a79a262032285a986d1e559f9743b0b998577a35cd99fa9121e69fdad24589e2002b393cd832e828f1595a2bd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795159, "uuid": "0e95a525-08a7-4dd1-871e-89742ad76e10", "value": "T1F0358E56EA5D2E80E76C4739C1F6D8B44277AC75A931D83F6CC4399F2AF668D00298C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795159, "uuid": "ac453132-815c-4152-9d2f-63b730daed05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795159, "uuid": "e5f4f251-4f31-4ec8-b7e2-8c7aabc4f2bf", "value": "12288:hYy8eR406SxcyltbLE1q6H3MFgYke3yVmoQ9OQei86DaiWIlc002rI+ppppppppB:x4ybvE1tMOYke3ynlZiWIirPjUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795159, "uuid": "81eeb7f0-e652-427c-a9dd-7b680520deaf", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795159, "uuid": "af6cc695-d582-4ee0-9a81-5263b1cbd8ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795159, "uuid": "d41e8f6a-727d-48ee-8c54-507245c36207", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8443cb31-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638802513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802513, "uuid": "2ed3a59b-82aa-48cb-ba7c-da87ed0b4fac", "comment": "Malware payload (Formbook)", "value": "ad793d8167ad5a0a867332cca76a5778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802513, "uuid": "084ba17b-a237-4d18-a7b8-e345be01a556", "comment": "Malware payload (Formbook)", "value": "c7a89255767729cc8f5dbd610779baac706af799ccbb1a4945c55a77632e671c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802513, "uuid": "0ca2ad62-8ad6-4568-9b2e-0427aa5f6189", "comment": "Malware payload (Formbook)", "value": "5d3b86cb834a9618a4899aeff62192859949e274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802513, "uuid": "03a9b8cf-4766-4fc7-b5dc-6bff872a0fa6", "comment": "Malware payload (Formbook)", "value": "4307abe66522ae5c964037d7ea4aed9dce1a1a569c5ccaad99feaa30c9f4b3c7101085a75823947f38c01f80e520db0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802513, "uuid": "2e1fba68-1c56-4d00-98ba-e225b53bcbb6", "value": "T1F8358D267290D873C23B46B88D57E7E41829FF116B64ED8B36F47C4E1EF9650B816283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802513, "uuid": "d36b9e53-420a-412c-9b5a-9b69e33ed564", "value": "63129113d28408f1ff3b0b14b238be7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802513, "uuid": "a6096890-6e7e-4d49-9114-3f5c5f26e811", "value": "12288:IZLuO0wmv2pdKSKVLmbPy7PXjW1ebIrUxhmKQHwy22NwtIKmmTIy7zdFRcqz:4CRv2pvAmbPy7PaYbIryhmNgtIKu85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802513, "uuid": "bdbcf7f1-6a3b-45cf-9613-1b8a1363c303", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802513, "uuid": "2d77908a-b2cf-42bd-9cb0-ff1d0442e981", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802513, "uuid": "26800b11-7598-486c-85a1-dadec3d035ec", "value": "Potvrda narudzbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341bb3a3-56a6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638803238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803238, "uuid": "bd5101d3-3910-4ab2-9d07-c0e0c16eee01", "comment": "Malware payload (Dridex)", "value": "955bd8fff912b2d7107f2d46c93ca6e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803238, "uuid": "91b68e3c-fcc8-4e69-a778-45b40204837c", "comment": "Malware payload (Dridex)", "value": "c855a3b8c681c220f26366b5d20fe746f2996a1e509c2cc6f49365ff7301d070", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803238, "uuid": "e547bfb3-41cf-40f2-aadd-11bf63658d88", "comment": "Malware payload (Dridex)", "value": "5982614b4d111d8471871b1385a2d936ba2a2600", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638803238, "uuid": "abc791ef-199a-48aa-b15b-5ab9d953222c", "comment": "Malware payload (Dridex)", "value": "28926a71f38f776a240c10a07ca5152517507119e866d16dd90e07657298eb0d892286d533a2e55149330ceca6d5ca7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803238, "uuid": "f80c0f39-2555-4a11-bc9e-14ccf1fe698d", "value": "T1D4A4AF469D16A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803238, "uuid": "cd398270-372a-4691-af37-8e151c9280ce", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803238, "uuid": "e9e5c0c0-ddeb-42ba-b015-8cf1f3c38ca8", "value": "12288:A7fimEsIsmY4K08oM1Wd8t5KQhNdv5zE:A7aVRBn7x6jtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638803238, "uuid": "cbe6f579-e2a6-449f-ab87-b5b9c5bcdddb", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638803238, "uuid": "f90201fe-e3fe-472c-8943-9eac120ff8e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638803238, "uuid": "e61740b7-2c00-475a-a1ff-96bd8c5d5ec3", "value": "955bd8fff912b2d7107f2d46c93ca6e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb95d547-5661-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638773856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773856, "uuid": "9d023af6-e9af-4f7a-b9ed-a1e3b21176be", "comment": "Malware payload (AgentTesla)", "value": "6ee193bd9216694059db084ca171b0f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773856, "uuid": "2c5c2424-35d3-40bc-9419-b850b32e688a", "comment": "Malware payload (AgentTesla)", "value": "c9da9a67d72b162c4031e69400158582f8876b03fbc021b57fcf1c78d17d4f37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773856, "uuid": "74fd7fc2-f10b-43b4-a919-23aa99047494", "comment": "Malware payload (AgentTesla)", "value": "8f9d84110344ded983da5ef17ba4a74fdf4133fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773856, "uuid": "f19d86f7-3409-4ce3-b698-ad2ccda3074e", "comment": "Malware payload (AgentTesla)", "value": "56ff538fa38803039fc8cefccb746a0d4c0f508404c976cb0f15b29dd0611683dbe556e6cb1b6c36ddf2586e2d778e03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773856, "uuid": "bfc256e3-3dfb-4db5-b0b9-5d29a8e20a58", "value": "T18F35CF88312471DFC867C4729E695C34A6A238BF837F410B605B269D9A9F743CF193B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773856, "uuid": "299b1647-103b-40f0-a701-414e2aaf3440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773856, "uuid": "63171887-14ab-4865-a03f-fcc4e9ea3843", "value": "12288:Ccmlk/txUPjd3gLILGzJ4brWqGVNPDGmpx6ws9KepRN+xtbrDfsGoK+hlpmiwOsJ:O6LlVNPDCqbrYv/mJqvBpQRIwlDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773856, "uuid": "48816286-b930-4a60-90aa-a0bf28686fbc", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773856, "uuid": "10391b64-66af-438e-a28c-0438a151be06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773856, "uuid": "6f218d75-7149-41e4-bf2b-a252bde48a43", "value": "2021_11_17_AB2106159__pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58952bff-5691-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638794279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794279, "uuid": "68cb7303-b000-4e48-8518-056b48088e7a", "comment": "Malware payload (IcedID)", "value": "eeec8c497e678ebff38d04983f99ba10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794279, "uuid": "e4dc2f61-2979-40e4-baf8-53ff2503b8c0", "comment": "Malware payload (IcedID)", "value": "cd31327b2c7b3d8e90a06c1194f847c81c51ac72d0f16db9aec520a594b84507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794279, "uuid": "6c02a9f7-4acb-4de1-8f67-44678665d303", "comment": "Malware payload (IcedID)", "value": "17cfe1d6db7008fa8490b82c5a7bf85a39748f50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794279, "uuid": "f2ad0261-be66-4fa6-966a-803e833153fc", "comment": "Malware payload (IcedID)", "value": "90159cdbe7a9335155d5c6d16ec46d5c3d59bfe2b82b10c7c431c14044d52b082af8dab5702a013ece77742cba85e6cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794279, "uuid": "bcb74f4b-91dd-4f9e-918c-f76829d95e61", "value": "T1E91538AE44CBC59FFEA18838DDA46AE3C293976ECD6AC9F34D8594302C114D9487B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794279, "uuid": "9ddd6574-f048-40dc-a0f6-8e501b2cf3ab", "value": "f6bdd1c75556d961afd6fb8104c342ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794279, "uuid": "434ec5d6-5696-4e0f-b313-3749546d2bfe", "value": "12288:HfdCRsouYgpzEvqM8dxJ6IO7ByLErvB67sZ:HYRx8V6IONyLErvB6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638794279, "uuid": "1b635da5-c09f-4ef6-9956-9c0896fc6339", "value": 889473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638794279, "uuid": "49f8d029-350b-433b-ad52-104d7d33b0a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794279, "uuid": "4300aab8-0140-4504-85bb-3079f3326e0b", "value": "youLoadLike.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbdfd53-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638765079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765079, "uuid": "c611f7e9-a0fb-4a62-8f48-c0e940d842ea", "comment": "Malware payload", "value": "340ad212a4e7b5ce380d05deee12cdf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765079, "uuid": "5b1c35fc-1170-455f-bf37-93bb4b84dc52", "comment": "Malware payload", "value": "cdd0d34714297037b5be052585421821a6c30d48866394ea0bb8c1a7f29a9195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765079, "uuid": "29f3d060-dc1e-4752-a63e-a0c4bb11e4e4", "comment": "Malware payload", "value": "f87dcbfa1d90faa456aac7955251a43ca7b396fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765079, "uuid": "a5379095-ef04-448f-994a-8d1322ceeab8", "comment": "Malware payload", "value": "db13024a726a71806e16e4dcfbcb9146d6820dc21ca8a7ca01f86336fb2489cfcc5db9110f35bc75b50e5d531195c1aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765079, "uuid": "bef33d04-6271-4626-b1df-c8f77acc9e21", "value": "T1F3D6338C61554DBAFEF3053F445BC619C670BC760BA2D51B0B19B1A21EDB6EA2839FC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765079, "uuid": "53ecdd52-293e-4d69-a91f-d0a72d9052fd", "value": "5324ac1e1bceff69ec8d4435c50bfe0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765079, "uuid": "7416e40a-460b-449c-bbbc-3ceaad0dc4da", "value": "196608:DIN2q2emhQWBhH5AvlvlF2CsXDjDyf6Zk1RiEFmM84Nfgaw9TThRNdeQo/:O5mhQ2Wlv2CEDnZk1RiEF7JgX5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765079, "uuid": "f3eda850-e82e-49fd-80c0-72919e024b31", "value": 13141022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765079, "uuid": "853768b9-e939-46f5-a8b2-01bb20d46faf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765079, "uuid": "62d3e518-d81f-4d49-af8a-86debecef253", "value": "SecuriteInfo.com.Variant.Tedy.26120.27608.20842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b72c305-5694-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638795573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795573, "uuid": "9bee2798-f041-4f85-8f17-b10542da8a45", "comment": "Malware payload (RedLineStealer)", "value": "7ec73fc10cfa5bcd5dd6f53e41517124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795573, "uuid": "35d5b2fa-114a-475b-a468-b7add0099888", "comment": "Malware payload (RedLineStealer)", "value": "ce18d078d1cd85b4cda1e9707d5d10e4c49a03cfeb075376e8f3da795697356f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795573, "uuid": "5e5c5f90-5ce5-44ac-8b5a-ca5387c4cb6a", "comment": "Malware payload (RedLineStealer)", "value": "975e7550a0afd811f132221e0566a3bc6a1e7fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638795573, "uuid": "f31afda2-dadd-49dd-a0e0-fb262a834976", "comment": "Malware payload (RedLineStealer)", "value": "cebc46dd8fa746d4749b3381e6a13e421e41917651e4b09103306c6f4b6e23ccb0a768d48e6da76ac1785d9b1956e7d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795573, "uuid": "750292f4-1256-42d1-9d79-85394eeb1a0c", "value": "T18694D01276D0D033C09264B58D25C7B05EBAB4711A6A6ACFBBD81FBD1F247D2A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795573, "uuid": "0536f84b-6833-4b3d-9773-08d17707b22a", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795573, "uuid": "001686c1-0f7a-42b3-9508-aefacc1de7f6", "value": "6144:jlJJicJ9oOVpuB9P71iJy5fUFtP+s/fUqfNtWkwc/drVQ2EXSNLNRJS16PWH:jD/J9pqP71WHFAs/fLNB1drJNhWIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638795573, "uuid": "327d9b57-3632-4faf-a8cf-bd608bb02c8f", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638795573, "uuid": "5bdff431-4c7c-492a-8d7c-5406df19f6e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638795573, "uuid": "362a109a-2716-46fc-ae44-d462e5d445c8", "value": "7ec73fc10cfa5bcd5dd6f53e41517124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67fd383-56bf-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638814247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814247, "uuid": "4c1e6ca1-10f3-4b69-bf95-20b8bf2eda65", "comment": "Malware payload", "value": "531b94f812dfcc632bfc8ac6190bd9fe", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814247, "uuid": "096cc3c2-95e9-4184-ac08-25d5c51164eb", "comment": "Malware payload", "value": "ce5ea54a04be2e6d119e978a0d3c7ab48094c3c1b6749b12a2ad06568a68df33", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814247, "uuid": "a4124c2d-ce12-49dc-92a3-f0ad1286e0ac", "comment": "Malware payload", "value": "6e340e0bf5da093a0ab0c69a074152979acf6ba7", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814247, "uuid": "bce1c816-ffb9-474b-9480-64f76c32baf3", "comment": "Malware payload", "value": "43c0a2f58d6a13bb21831eb9c64fda347f8dc940bda5d56819c5a0123515ccebf40e985d49c5a73aaac6e132332349f6", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814247, "uuid": "9b7aef4b-4f78-4007-984a-bc5e64701935", "value": "T12FC47E57F7CBF6B0E6FE867A86F1851C52B774620260A78F664072886D22392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814247, "uuid": "ef1b87ef-c0cb-4fe2-81ae-bbf1b121b743", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814247, "uuid": "36bde7ba-e926-43b2-a0a4-a13fe22c4359", "value": "12288:Wn/zDvGHAykH8vLW/4+8bzbBSreMdyBY4ZyrE7K3yl8PeVooA/AB2LEJZLoCAQP9:EzbGHAzHKjX15BY4ZyrE7K3yl8PeVoo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638814247, "uuid": "9f728397-1d38-4c69-a170-ad5c4d9efb9c", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638814247, "uuid": "d3916f0b-b91e-47e2-bad7-cd12fe0041ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814247, "uuid": "50eb2e5d-f5fd-4c57-b62d-a6201ba2bd96", "value": "WF_Payment Advice_211264.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6815bae7-5677-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638783138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783138, "uuid": "b9f154ab-7c34-4ba3-ab70-5bc57d690525", "comment": "Malware payload (AgentTesla)", "value": "0141d1522578d120654496b31324f27c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783138, "uuid": "17b8a9fc-21d6-4940-bad5-ead5d91c4a44", "comment": "Malware payload (AgentTesla)", "value": "ceaa938799edbca78669209d7ef6fdd1584f2489be0a33fa906251b9edb1df54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783138, "uuid": "d6d1d5e6-fbca-443f-8561-fc1f362cdb19", "comment": "Malware payload (AgentTesla)", "value": "cded40d4f461b10dc832e025f02e6658c0fe569b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783138, "uuid": "f15f6963-0625-4027-a7d1-8a2876ba1551", "comment": "Malware payload (AgentTesla)", "value": "ebecf1f2cf897e48dbb823bd3d6566d5a8b0089c15fa1d50a3cf84a0675ab70423187355d35176d54ae62ed8626e3e27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783138, "uuid": "83480a94-8eb0-40ea-a2e7-d68399457f23", "value": "T1DB9423432AF4A91BD792C1728DB159B2D3FE91A1344AB62723119F7D3CF31B74C0915A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783138, "uuid": "7adf29f2-726b-4b9c-b3db-7f71bac08534", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783138, "uuid": "8e8ccfc4-4eb6-4180-9935-03251df11742", "value": "12288:VLTLgOH8OF3/QU+0P3MvLvEzpI+nSRiKr:aODF3/9NP3MvLsVIASNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638783138, "uuid": "70d170fb-cdab-4e79-90fc-59e51fc8344d", "value": 411589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638783138, "uuid": "f9ff9d19-0f20-46b1-9b90-cd7305c0abf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783138, "uuid": "036b27bc-75f7-4142-9e5a-aba4c470997c", "value": "Remittance Advice -(DS78B) Payment# 133060908_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a5ddc7-5667-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638776175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776175, "uuid": "19e17749-cfc6-4e96-89ee-a070c7eb1964", "comment": "Malware payload (Formbook)", "value": "ffcdef3f58aeadd259d91bde6135e90e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776175, "uuid": "fcf0c9e8-dd04-495f-9753-d9cd137467c3", "comment": "Malware payload (Formbook)", "value": "cf3a7e79e4f3b700e4d581b5ea46bfa8f2605ac0a204214fd3a08a6da3d14892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776175, "uuid": "58133ccc-682e-47a7-b619-2d22f5789ff6", "comment": "Malware payload (Formbook)", "value": "f8d7b0ec050b3d5570b9dd36a9e7bbfa98e6256f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776175, "uuid": "34fde3b1-a98d-484c-b1de-f7112df8e161", "comment": "Malware payload (Formbook)", "value": "806c7a85dd243823871f70c0e79a52614cffb653d894a2c4768e76b76053ec2b5bec26eb27984a7438fb2ebfc24949ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776175, "uuid": "6b74e94d-2515-44d5-af80-693a83778beb", "value": "T14364120E77908993D8C344322637DB7ED3BCC994469B050753A0BF4F5B3AF8B8A65692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776175, "uuid": "975209f3-be12-41dd-9e54-32d995e62d14", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776175, "uuid": "91d11834-cfd2-4bd0-b4b4-a08db3ea53ad", "value": "6144:rGiBioyWNe1w56IRTrHhoY/Hmm1urWc7Yxl8A1EDnKUju4TDAe:tisw1w56qhoY/HmTislsGnKGTDAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776175, "uuid": "9364a34e-126c-429f-8be1-d75111c845c2", "value": 319890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776175, "uuid": "0d04c0f7-e17e-4ca1-b5e9-b463bf499b17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776175, "uuid": "d8d5daa6-79cd-4842-b8d1-a596fd7dd00d", "value": "ffcdef3f58aeadd259d91bde6135e90e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf208fc5-5671-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638780734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780734, "uuid": "d9134565-68f1-4411-adb6-de8860191cc9", "comment": "Malware payload (Mirai)", "value": "75160092c39c7d46d64345e8ecd687b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780734, "uuid": "4c242c34-777c-4a5c-b4d5-48d4dc3f2e91", "comment": "Malware payload (Mirai)", "value": "cf561d0fcd582bae4103e7bd78af16c43080144127ff8cc2e482118ffec26df7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780734, "uuid": "e5105c8b-42f0-4c7f-afd4-8be896e62676", "comment": "Malware payload (Mirai)", "value": "54118467e5ba27cb28165e491607e1879c3a08b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638780734, "uuid": "e6a7dc59-028f-44b2-b149-a734416a5bbf", "comment": "Malware payload (Mirai)", "value": "950fbfb9c8deeda7f04cc5d7aae9118697061e3d91222edea59ea7232c1acfcc00e3143ae7cbe3ecfe013f5eba868c6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780734, "uuid": "3b804b1b-ead4-4e52-9074-f5c3225250a4", "value": "T13EB3193B7B170F63C0CA107111E31732AAB5D79A38FD5397A9E02DAC2F169843956BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780734, "uuid": "9b07f720-b858-403f-a679-2af57e22dc34", "value": "1536:tcF6+1IwptpENM5fWdtrk92/ZIeY7is4DchYho/Zv7hKrgkK:2PEN8EkXSDchYho/ZDhKskK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638780734, "uuid": "d6bf6f11-c834-4903-b0ab-6c1ec56437bb", "value": 116382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638780734, "uuid": "f54c9a9f-b417-4dc6-9c40-aeb0d5f869ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638780734, "uuid": "e53e33c3-8650-4850-bf07-20b86d695b2c", "value": "75160092c39c7d46d64345e8ecd687b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd651a2-56b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638811522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811522, "uuid": "a222d6fd-b1a3-4490-ba85-20f1a657f21c", "comment": "Malware payload (RedLineStealer)", "value": "b65c547ccdbfd46c3c8f9e607c9b98ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811522, "uuid": "26f04ba0-fe45-4f96-973a-ebdf8afa8dbc", "comment": "Malware payload (RedLineStealer)", "value": "cfc01921ce3b9a59caeb342e9eee604f9dd41fb2a402e0651941ece164957bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811522, "uuid": "2f01d10e-06fa-4ae8-b860-3753479c3f0b", "comment": "Malware payload (RedLineStealer)", "value": "78713b588c0873d5f79e774c57b63d91ea9cbc33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811522, "uuid": "63e38dc3-e08b-4ec9-a1db-a10d77811344", "comment": "Malware payload (RedLineStealer)", "value": "dae765f7c97c8c36ba7b042d0db42bd0001e4ba23d00e220138f09acec22bcc845094cf030eea3b3356b72b26aa276c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811522, "uuid": "ff4f9d7f-22d7-4b18-871e-e4f80e6d9ea8", "value": "T143244B2C73489B20D7FC4636C9E14210E3F6D89B9547E72EA8C475E53DA2F94FA0274A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811522, "uuid": "b17a70af-98e7-4ea0-9c53-3dab3c200830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811522, "uuid": "725a5b81-43e7-4552-a07b-e76b0cb6dcbb", "value": "3072:HjQ9MaZrcJDziu4MFo8yheyD9cPRE/5zXDPS5CkZWLx72lffQ3PC6hm3u:HjQ9jZqiLJ6elDPJkwx72iKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811522, "uuid": "37f8ee29-ddc8-4dc1-be4d-73dfde81708f", "value": 222936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811522, "uuid": "df546511-55fd-4b57-a5d1-16de80f70560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811522, "uuid": "c6e73a1e-3f7e-4f86-ac3f-807161c48686", "value": "cfc01921ce3b9a59caeb342e9eee604f9dd41fb2a402e0651941ece164957bc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da81fc9-56a1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638801213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801213, "uuid": "a5e31626-df60-4303-b0bf-5461415869ab", "comment": "Malware payload (Dridex)", "value": "cdf3b326951bd5cd55254e5599302183", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801213, "uuid": "a4dbba3f-2be4-4d86-87f3-1f8e8b496d90", "comment": "Malware payload (Dridex)", "value": "d0681c030a51811edc6f19b6cc418043ef928e251c681cdf75a05949f932340b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801213, "uuid": "d95bfe67-943b-4a46-833f-1226e8f01eee", "comment": "Malware payload (Dridex)", "value": "217316d0d637d818e2d2d22397222d715ed7b64c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801213, "uuid": "902bda95-af39-4e7a-b182-4e22fde1d2d7", "comment": "Malware payload (Dridex)", "value": "aa13e2bc19bca8d0412de208b969cf22b830bcc676f9fa8c82690f3f6b331d78e57a4b8568205f21aa8c7218102c1420", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801213, "uuid": "c095087d-0dc7-4601-b6c7-b5c371a63343", "value": "T1CBA4AF469916A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801213, "uuid": "1df0ca62-8b38-4055-b648-bf486554ddb6", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801213, "uuid": "6d941aee-c2d4-4efe-854a-8b930b2ecade", "value": "12288:j7fimEsIsmY4K08oM1Wd8t5KQhNdv5z+:j7aVRBn7x6jt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638801213, "uuid": "edabd18e-7f83-421f-b65b-f68f69c87f40", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638801213, "uuid": "cf246e25-9970-478f-bca8-96258ae4b066", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801213, "uuid": "f9b9e078-6222-4d7f-9abb-4eb55bd382dd", "value": "cdf3b326951bd5cd55254e5599302183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624a81ea-5679-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1638783988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783988, "uuid": "e3ef24f5-9955-49f5-affe-85ff6e22e749", "comment": "Malware payload (AZORult)", "value": "c300614ac0653c32642d552ba9605106", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783988, "uuid": "9400ec4d-d4d3-4d78-9412-2d9f51d49533", "comment": "Malware payload (AZORult)", "value": "d08b2a88da6aa62db9dce323f2b39416f75d0bd437accd87952c6f17f57eea33", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783988, "uuid": "9ac28b77-9477-4a74-b682-e100b9b5d8aa", "comment": "Malware payload (AZORult)", "value": "452e16e3dc7975d06d3a5bede656c3f7359f9cf4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783988, "uuid": "77f2e6b8-86ab-4b67-b8ed-7c4ce2be26de", "comment": "Malware payload (AZORult)", "value": "b328954ab64628d7d3af7e855d24c5fed3dd54f037fdc3dfbac45b08b4bd9f42d1f6c8c88bc83d3f6a3367cd6bc27c91", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783988, "uuid": "25682179-ea53-437c-897a-65c31a050443", "value": "T1F555B687131A84B3DE5489F1212BE75DF3F42A366370E82D8ABC9D04D160BD5BE8E91D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783988, "uuid": "ec573db5-9ef2-411f-ad0c-ef50f661c58e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783988, "uuid": "0b596d12-b293-4a47-bc49-1fdad23431b4", "value": "12288:+bXF2d7m5er9HdwS7SKEnP8cIQzlBFYRS+rgNQsMKX:+Id7m5er9Hd57+nXz+la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638783988, "uuid": "bcba8c68-8c17-4d9b-b514-92765ca8aab0", "value": 1350144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638783988, "uuid": "6d0b0b72-e429-4373-b4d2-58a3c708e600", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783988, "uuid": "07cdda37-de12-46cb-bc27-6a1115aca978", "value": "d08b2a88da6aa62db9dce323f2b39416f75d0bd437acc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa2d837-5688-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638790605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790605, "uuid": "ccaa8418-9b68-4c57-9716-26fb4d2d7152", "comment": "Malware payload (RaccoonStealer)", "value": "3728511b2fa76fd5c6fdab4ebbd2b9db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790605, "uuid": "91d7745e-e51a-4e03-b07c-a82fc47fb1e3", "comment": "Malware payload (RaccoonStealer)", "value": "d0a2d38c92632c54e617a3a347f36fa57baeda485329bfc4504b472101b65b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790605, "uuid": "8328ba11-9f79-4a7a-bd0f-c326a462b853", "comment": "Malware payload (RaccoonStealer)", "value": "23eaf23c1ac28ab7f2f0d4831bf43947f70b5625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790605, "uuid": "3efa778f-3cf5-4cd1-8d42-25e014338781", "comment": "Malware payload (RaccoonStealer)", "value": "826dec0f60c3d255e37f34d28fab931450fcebc4f468736063a98baabe0e0f50001a581ba12a9230c11b6fd7a9d5372a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790605, "uuid": "92d4f908-416d-4d60-aaaf-ad39d67d37f5", "value": "T14A549E2133D0D032C49725768524CBB58EBAB4712A666ACBFBD41FBD9F247C1973530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790605, "uuid": "fb862bfb-ee9b-4878-89da-22b53b6bf186", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790605, "uuid": "3d4be086-5831-4ba8-bdbc-a8a0ead3796e", "value": "6144:ufH1RXRM6p/3wppTtvt03pYtHt3NTBPjAPw:ufPXRr4f9tHtlPPkPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790605, "uuid": "880aa9e1-da07-43b3-acc0-f95c3935f273", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790605, "uuid": "9baadfb7-f400-4009-b445-4d4485520bf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790605, "uuid": "c35e9a29-046d-4661-bc6b-0990adbc2734", "value": "3728511b2fa76fd5c6fdab4ebbd2b9db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba464b6-5662-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638774286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774286, "uuid": "e0e336b0-f53e-47fd-b1f1-1d84dd673369", "comment": "Malware payload (AgentTesla)", "value": "eb706396b34915b8a03f44a971037cce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774286, "uuid": "45bd5413-4a7b-431a-abc0-87bf5d3165a2", "comment": "Malware payload (AgentTesla)", "value": "d0fc76c807806082c2e1940d60837a03ceeb1d4eeb3f04b62c8977e3d74f8d15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774286, "uuid": "91a82c68-abe8-42b2-8651-bb5eba5bd285", "comment": "Malware payload (AgentTesla)", "value": "b306b5427123acd708e5c471ed0648ce18238d7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638774286, "uuid": "16942ce4-2834-4f86-a546-a763274e0a9e", "comment": "Malware payload (AgentTesla)", "value": "f0258108c60404e112c1c8c612e5d0376644fcf0c71d51ac2bf09cde9e76bb7d9771dba3029e725fa762ce4e39789db1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774286, "uuid": "27281298-b660-436c-931c-ab4136d7fc0d", "value": "T10AB401047BD4D91AC32F8BB5E8B091F16971BE27FA62D3DB5880FD5E38B63021511B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774286, "uuid": "fb58bf8f-0449-4715-8f6d-58c86986fa7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774286, "uuid": "6caebe5e-5165-46a3-a441-7dc5d1813f37", "value": "6144:OtEvECznFpoD06LrBqT5looG07a+o5e6f66ofG2RLp2SJYn4baskjjBSuBkR1vWU:OYHH6XYCc7kc6i6ofGwLsSdalJmAl6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638774286, "uuid": "efa714bf-9a1d-490b-b3b6-7489a6802a3b", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638774286, "uuid": "89c319bf-e4c4-410d-a49b-e90d81393a2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638774286, "uuid": "f1649f49-9cce-44eb-84fc-aa6d7bea64d4", "value": "m4NHteChUNik69Q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9aad48-56c0-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638814365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814365, "uuid": "e463443c-a6e4-49fd-87a2-43303ed68727", "comment": "Malware payload", "value": "acc7a78c974a9e0de27c499e207a6467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814365, "uuid": "2e426a2f-7123-4c90-b979-40b5b8042378", "comment": "Malware payload", "value": "d1fddb73e4e00bd2b9d0596d36572c3493df2ca53f0bf229fb46dd1e8ab41c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814365, "uuid": "fd9cfa60-148d-4ff8-b9e4-4f0b00d9e7cb", "comment": "Malware payload", "value": "a6c16ed8435691b30f5f425a8cc3969d31e7057a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814365, "uuid": "e2848dea-280d-4383-9343-c844c6fc09aa", "comment": "Malware payload", "value": "fd3d9b732a5d5ae84fe2864525c7669b5c4781d851d0b0e7ff8df3fbc366f165ac0800401fa4f69968f0e377320d7e18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814365, "uuid": "2054b5ef-46c2-4c84-8624-7a66f82b7c46", "value": "T112E32862F9546406E20788F1B429A30C1425FF3D7731A5EBF3B5BB19553229E60A2F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814365, "uuid": "3769d3d6-17dd-4d51-8277-0a2bfa178eba", "value": "51127e9f9b7ace209c6642a5c0586a83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814365, "uuid": "ce814e34-5fdc-43cf-b94f-ef4a54aa634e", "value": "3072:I43r2Qd5MbP6bYFK5qi96RpMk9MMYHeA/ZT8sMBjs5m:zrvdCbPAYc5cpd9MMYHeA/ZpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638814365, "uuid": "90d91b5e-8956-43fe-bdf2-d2168fe61e56", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638814365, "uuid": "1e17d5b7-7a8b-4d0a-8e68-485f6f489a19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814365, "uuid": "35ffe3f0-dd8c-433c-a382-66483ad65c16", "value": "credit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8898d978-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638802520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802520, "uuid": "22145ce5-3352-485b-ac65-2c034bf9aced", "comment": "Malware payload (AgentTesla)", "value": "5657897232d2e5e7d6bb4189b610334c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802520, "uuid": "147a30ef-f08e-4e10-8572-ff12eb6e574e", "comment": "Malware payload (AgentTesla)", "value": "d2002bd79b21bd70e3b00058d4a92ee85e8278fb5dc6c20964a2fdcd72abed73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802520, "uuid": "eb42c6a6-1b82-42ae-95f2-3acb33eabb79", "comment": "Malware payload (AgentTesla)", "value": "ea65423eb6a0b8af9f18da7689bb31c9d8cf1ef4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802520, "uuid": "5702e715-d2f7-4ea7-8353-4f423bfab198", "comment": "Malware payload (AgentTesla)", "value": "816957f145d26c1c670a947a0b49b12e034dd61338c0f7ec2d058061652633ca4be2ff64a0fcd7fd28f1f1ffdc3dbedb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802520, "uuid": "ba3c49cf-5d62-4e00-8b07-f9a00235e7ed", "value": "T173F4125933848B49C829BB701CA1D0B503B675957852C717BDEC76AFBF363802B03BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802520, "uuid": "a7f5716e-a32b-4499-b69c-1d3dda9c1663", "value": "12288:u2iNmN6ha6Fg7MbJkozT4T2PgFZIourhI+qaZVCmtD00Qifo:u1MZ7Md54NiouBbC0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802520, "uuid": "5ee8ae06-a3b8-465d-81b5-96ecfbd1bb78", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802520, "uuid": "7ff7388b-3140-4e65-a366-120e0291aaf3", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802520, "uuid": "e85bbbb1-5605-4f89-9795-f97e7bef3865", "value": "Re Confirmaci\u00f3n del pedido y pago,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb88a88-566b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778210, "uuid": "cf159c8f-5289-484c-8781-a2fc32931e43", "comment": "Malware payload (Mirai)", "value": "ae0f0bffab55a406dc9e2bf431942e01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778210, "uuid": "e2dd8c37-6fef-406e-93e9-f899aed38eb2", "comment": "Malware payload (Mirai)", "value": "d266b7adf041cfb5b1895a621f320efbc9a795643c8ffe918db056fcf327f7a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778210, "uuid": "8e077bd2-8fc8-41ef-9480-9a965f3acde6", "comment": "Malware payload (Mirai)", "value": "ef7018fe026567f41f23c34fc49f4eb9b430b162", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778210, "uuid": "07047b7b-aa9a-41ac-aa46-95bb7a4cd83d", "comment": "Malware payload (Mirai)", "value": "d5fad072292771ebfacd01778442a24da43d4e2eacb201d3d362a0b85c4a0b58e18be4790c039d647595cd376f49d343", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778210, "uuid": "aa4f4c01-767d-46a4-b40a-4806dcc87972", "value": "T120A33A4399619BB3C056A9B115BB6A340713A8920F4F1B98723D9BF8470F8CDB50FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778210, "uuid": "fd6606ef-6aeb-4531-8c2e-99060bcfe98a", "value": "1536:i5iBWqpOeCZuB9jucKR142lykTuYr1XRXCRFPK8ZUmjWViYEylO4Ze:M3eTrkR1ykv1RXMPdZUmjWViYTlO4Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778210, "uuid": "dce35cbd-a957-45e7-94a3-b16851fb0cc4", "value": 98182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778210, "uuid": "884cb2c1-4ad5-4ebd-8321-a3357b325efc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778210, "uuid": "335a034a-e494-4a9b-87a0-bd304d76497e", "value": "ae0f0bffab55a406dc9e2bf431942e01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca347b8-5699-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638797829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797829, "uuid": "11abebed-7c4f-48cf-98e5-f10a119050d8", "comment": "Malware payload (Formbook)", "value": "6e976bdd711770b20d6664fd18fe5c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797829, "uuid": "b6ffa79b-ef94-4ce7-8c45-16764b53d89d", "comment": "Malware payload (Formbook)", "value": "d2b976a493c6d3b694dba0e139cea1d4943c0176a807109a9ab045a6b23b75c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797829, "uuid": "0618e619-9d5a-40a0-b8ea-f6f0581581eb", "comment": "Malware payload (Formbook)", "value": "168d5d7bece8d371a379148c1988841e49b21ace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638797829, "uuid": "2b6447a8-2929-4f52-ab1e-9c60b1c71ad3", "comment": "Malware payload (Formbook)", "value": "4e653ef5919d8d6a21b516d2f36975e6a99d030acb2d8f09f7fa87558ce40bbddf7a91367b157cce8e1cc9dd2d80e74e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797829, "uuid": "001e7869-b0a2-427b-98bd-04fd32116348", "value": "T165557A1C26B5086BE97D1A74042547774EF26C3D997BE3CD3B88356B0BB26840B263ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797829, "uuid": "3d095c97-e158-4d6b-bc15-517b40d730bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797829, "uuid": "714a2f12-e774-42cc-960f-ab7aa4d19cc2", "value": "24576:nmdzwA3j/gM9/gaKmL2zlkObur31jmdAM70bqxk1vrvLWI1ZiBZC+gLR:6IMJR9ANSrFSdBwbMgTrSBZCJLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638797829, "uuid": "cfb902db-14c0-4a4a-83a7-d087a5127030", "value": 1316352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638797829, "uuid": "fc384e9d-ff8b-480d-9b34-2b55cc4cd1db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638797829, "uuid": "d2e212b5-5934-4af2-abba-9513aecc95ee", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ce2409-56a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638800741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800741, "uuid": "af086116-6e52-4160-9781-382e5b5a90c8", "comment": "Malware payload (Dridex)", "value": "e881abd0b93c42844009deeb24a49084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800741, "uuid": "22c5fef8-ab76-4880-bd0a-a31cde4922ea", "comment": "Malware payload (Dridex)", "value": "d301deccc78473443431e5dbfd9bf820d0659a5b747adf64ee2d178084cfabf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800741, "uuid": "312e28d3-81cc-4dc6-bf03-dcaf5d189f78", "comment": "Malware payload (Dridex)", "value": "74b0c7e1dc6184419ab88b8397cc4a5aac40209a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800741, "uuid": "657794d8-4aff-4464-9c97-00421cd0daa5", "comment": "Malware payload (Dridex)", "value": "376c579447cec97e6a9c2ca400fe30c8e8888e9bbf4483ece5f28e4431732c6802d894ea5b6ebc99aa4e8fabf9fe7717", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800741, "uuid": "33c4bea8-60c5-4bc6-b34c-cc4471b2b682", "value": "T1AFA49F7CFCEAB436C411C7F0987793990E352619E3FFE6E0362B9087A7566600A4589F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800741, "uuid": "c3a49e15-b132-46ba-8fb9-2dc04cc16cd4", "value": "5293be9dcc3fe4423188dd90c7dd2d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800741, "uuid": "3936f8d3-8739-4483-875c-1dfe98189804", "value": "12288:SQG80io88EmEkECG2EGoyEW+DBY49h4oJIH7l2:/G80io88EmEkECG2EGoyEW++HKyl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800741, "uuid": "29c7aa41-06a0-42ec-b938-cbca48e4d10b", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800741, "uuid": "10d26b7a-8aaa-4fae-84c0-63724a955b8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800741, "uuid": "ae886c68-621b-4f1f-8a66-5cbaf77fe6b4", "value": "e881abd0b93c42844009deeb24a49084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df00d51-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1638808918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808918, "uuid": "345e09f5-f759-490c-82ce-580f205c1870", "comment": "Malware payload (Quakbot)", "value": "15f3b7a631e85e9fa926a31c03577cde", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808918, "uuid": "74856360-edfd-475f-9b2b-5ab1ac918012", "comment": "Malware payload (Quakbot)", "value": "d3a98cc1d81262f39e4e32793c7f6ffe4c07c6bf9c2421159da0730084f3dfb7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808918, "uuid": "2d10f390-bf56-4929-86ae-9530dc22229e", "comment": "Malware payload (Quakbot)", "value": "35c69c0e90dad72f1ef9bff860d8148a8609593a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808918, "uuid": "d62c2cc9-883a-4e30-a861-ad67c40edde1", "comment": "Malware payload (Quakbot)", "value": "0684c8a91609206e25c34c463fd96b4066a0abc1c3c6c6cb33ac303a02df43a24727c5197b71d6461ee736ebe8edce91", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808918, "uuid": "86ce0884-b6c1-45ce-a93d-e1cee8cfddb7", "value": "T1E853F2ED9A06A35DC5166421115E8FF12C83085D32F64A85F2EF8CB39B2E83876E4DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808918, "uuid": "501d516c-3f6c-4c46-aee1-8d54756ba7ff", "value": "1536:WUfATDj33gEy8a0PFHZo7b2oHSn6ymHL/XqRo6:5fAzObiFqGoy6ymn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638808918, "uuid": "965ef3f8-271f-42a7-8848-f2bf7592473c", "value": 62101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638808918, "uuid": "807a408b-1ca2-4533-bb2e-3e7d1bf59a4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808918, "uuid": "4bf7c8ae-07df-4c21-abd7-df73c9d74557", "value": "q-2377536609(3).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28307ccb-569f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638800211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800211, "uuid": "b0ac5afd-ed39-47be-ac27-4ffbbccafb63", "comment": "Malware payload (AgentTesla)", "value": "ee4d83b3b9cb5e1f371768ac32242f0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800211, "uuid": "065e2e8b-8755-47c3-a851-7194c8783ad2", "comment": "Malware payload (AgentTesla)", "value": "d453016752922203429aeb69bf3adc098fd2ab61bbb37af7bcd630c99ad48b30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800211, "uuid": "aa3cf130-d273-4e85-aaab-f8cff55fdc86", "comment": "Malware payload (AgentTesla)", "value": "d702e44587fe14525a09cabbbe0c91091740aa6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800211, "uuid": "7adc5cf3-50e8-4fe7-a33b-c4a53c6ce2f4", "comment": "Malware payload (AgentTesla)", "value": "1cc78876c926fe96a1ce5baae963eeafd5cdcb6261624dc7c1a9377218a4e47ea090cbe6fb287b4f818da60ec93fa607", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800211, "uuid": "ca87b292-74d9-46ca-963c-b1879782de83", "value": "T11F657B5C317025AFE83A853145541F779EF12C7D826B93CE731734AB8ABE9428F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800211, "uuid": "a085b610-ff31-4792-9aa1-ac55f368c75f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800211, "uuid": "b58a0712-033c-4a49-8765-9e5e803da557", "value": "24576:GodcL3ZIU+z75BGXP2HHXAwiuvkMDny9GQd7G0O7R:GodcL3ZIxz78ooSTry9cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800211, "uuid": "35e26cb8-9835-462e-997a-01e1ce12fbe9", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800211, "uuid": "b71f5705-bd61-4f7e-8bd9-d96a171dcb26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800211, "uuid": "5b5fbdff-094a-46da-848e-53d5d1826ea0", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db7df81-5666-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1638775820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775820, "uuid": "2a95452c-1ea0-455a-918d-797533088c34", "comment": "Malware payload (Gh0stRAT)", "value": "921211c93c0526423bf3449cb33690ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775820, "uuid": "331b0b03-0f8e-42b4-a512-b439b7ae44c2", "comment": "Malware payload (Gh0stRAT)", "value": "d5118735db884a3f2d773207dce44bcaddcba024d8a9877e425f06c3db9dcda8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775820, "uuid": "182001fa-e3ee-431d-9a4a-47b816274128", "comment": "Malware payload (Gh0stRAT)", "value": "45eb2f70b41f7e782ff27fe6e419bad0e2f00119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775820, "uuid": "6e846344-9e41-4a68-9223-c8a24898f3b9", "comment": "Malware payload (Gh0stRAT)", "value": "d220cce939329a74ec2580b5221cfb7014a58749ecf2698bf5ddcc04e87a19b150b8fffeca01473c3ccc0d2bd3c5e846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775820, "uuid": "dfa26be6-2f89-4c9f-8b5c-9c9a6034f68d", "value": "T1321581A0E451C46FC3F18632C5E5CD692424FCD1C09F65AE63EC3BE92A36AF682C156D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775820, "uuid": "be18d78b-5d3d-41ff-89ea-5016116d1761", "value": "89e037fdcbe0c78bab99535635579d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775820, "uuid": "1bc62cda-52d1-4d68-b44a-f68f68c1e8bd", "value": "12288:KoQP9Dmmd29WlA0Le1/5n+zNOzG+ND2wUkGZ:Ko689WlABn+zNsG+AwUkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775820, "uuid": "fa20c2ba-6139-42fa-8dfc-81f0b03f9735", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775820, "uuid": "ff22451f-b302-4e20-8b00-d2a1dacec933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775820, "uuid": "f0c3b118-3be9-4382-993c-4d306caff3cc", "value": "f_00011d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ba01f8-56d1-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638821890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821890, "uuid": "5564d303-1b03-4a09-b29d-e45581e1d3be", "comment": "Malware payload", "value": "72279a724b8cc88076877472edd8583d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821890, "uuid": "c98655ac-b919-4ac5-9189-96d5364c4546", "comment": "Malware payload", "value": "d635a02a16bdcb62bb6dd8ae199cc5efe49663417060b286224535e6432c71ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821890, "uuid": "a9cf0a63-f2e4-4cfe-b84b-81b80c32ed1e", "comment": "Malware payload", "value": "ace95463348c35469da495518cbb7c483f5530fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638821890, "uuid": "6a0f0899-f90c-45eb-9371-ffad8ad88700", "comment": "Malware payload", "value": "0dfb899359381245e29c8ac8b3034a37e4377d4cf3d857a76a3ac63dec3e989cb373bc07754d4ebce28daf13b6c8a83b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821890, "uuid": "0c7a5fa0-e8ce-4ae1-ac7c-895dcf876018", "value": "T118B4D04636D5D6A8F87BFBBA0CB075C103B5F6E0E941E6EEEDC4109698627914F00672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821890, "uuid": "dfbf9bbf-8e70-4f74-955e-9896b6a43b47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821890, "uuid": "57fc9775-bddf-4f22-8b3f-0c00200aa863", "value": "12288:zlVqa2iNUi9oOiZ4aNFPAUIgBMsQq9lqHdUi3Aa:zlVqa12i9kZ9fnMHq0J3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638821890, "uuid": "5144c724-b376-4a3e-9e1c-cad34d77f942", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638821890, "uuid": "6541b7bc-2c36-4747-b62e-40182cc05c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638821890, "uuid": "b08916ac-2e7d-4fd1-806e-50d1e6cb6c52", "value": "sQUGZTa7Ae6nYeW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d73a7d-56cb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638819296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819296, "uuid": "aee6844e-1df3-4959-b62e-2fb422138416", "comment": "Malware payload (Dridex)", "value": "515c3151e59823e47555c54efcb79f29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819296, "uuid": "ebef65ec-9728-4d8c-8a9c-03164e31972b", "comment": "Malware payload (Dridex)", "value": "d6a5d4bec8bc88217fea61b21c8b346d80fcbee3dcf602d717f8197cb44ca840", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819296, "uuid": "cf9ab40d-e0db-4631-a845-9d0c5d57d847", "comment": "Malware payload (Dridex)", "value": "d15fba9c73d97dc6e117222aa054efbe841bab9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638819296, "uuid": "673f80b2-7e96-45ff-b2b4-d26fa3d2b0c2", "comment": "Malware payload (Dridex)", "value": "3e8955b585068df6c708bf75b355d3f7e9179a9432202420888321b9fd62a09c893335da3db5ff34514bd5de3f4b57a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819296, "uuid": "6e44e7cc-861f-4c0f-a54c-b74f0019d4f4", "value": "T138C312C88530142CD88BD0B9665E939F4169A942D74BB5CC2EF63CFD6CA630F6789B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819296, "uuid": "f618ef80-5ab8-487b-805e-077aab43a658", "value": "3072:o/eiix7sMlEeFx5rAZhFBQdjDEcvQwhelhlKs1sDd1v:SeivalsZhF+JDEcvedjGDdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638819296, "uuid": "27d8a595-c6f3-4c3f-9b3f-9b583a9f4b5f", "value": 126506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638819296, "uuid": "baa0a44b-3f4c-47fc-9770-80f9bc684054", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638819296, "uuid": "895d1fad-dfb4-4a68-bc29-9b7dae6b7303", "value": "act corrections12-2021-15306565.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98657bc-566b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638778202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778202, "uuid": "840953b3-1ba9-41c7-9b43-620f5657cb41", "comment": "Malware payload", "value": "2d37bf692d208472fad9697fa472bf67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778202, "uuid": "a9a2671b-dc72-4ad5-b6d9-0f1c5a2fdf61", "comment": "Malware payload", "value": "d8466a7dc5f220976e6c7c679bf07cbeb35b53124d60509f85bef66e6f289c60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778202, "uuid": "a8b5752b-b7ac-4fe2-9a97-2c8cd8caba98", "comment": "Malware payload", "value": "2db908f0ccaea6a32c5364a6525ba15f88f031e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778202, "uuid": "d56e0674-2bed-42a6-9625-642f856359c0", "comment": "Malware payload", "value": "ea673e572663850db800e9770bb61837514753dcaab5284f22ff73660d5d7172b87c23d38587816a18deea11cb36442a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778202, "uuid": "e84d759e-b3b7-462b-889f-6b64759f47fb", "value": "T14803E139F0D8795ACDBA5AB10E3992D13F130A897EA25ED75445FF810B378701F499C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778202, "uuid": "78f1f09e-d883-4c3b-acec-ffbeb8f60def", "value": "768:p5U8UESv2xAAnodwybWTPfLZk7d1FrOrtjir6wGcX2f84uVcqgw0ztOJAmqggy:p5/hSvIARdweAZUOArK02f84u+qgw0z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778202, "uuid": "adacd961-f8bf-46ec-9059-75d2697b99f0", "value": 37852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778202, "uuid": "ce55c00c-62ca-4b37-83d7-e928d2fc001e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778202, "uuid": "4fed7d3a-dde2-425c-b9d0-f2df140511aa", "value": "2d37bf692d208472fad9697fa472bf67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea76e840-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638809127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809127, "uuid": "0afe3f38-d550-4a46-b283-7ef776c22180", "comment": "Malware payload", "value": "f7d8906479880474416d41e1993cb141", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809127, "uuid": "7bb4f7ca-d7d6-428c-b11a-7c6cb5094401", "comment": "Malware payload", "value": "d87e873e67a7c7ef4780e82e3a25d66c4b49e8e1d18a6e0106d76712546baecd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809127, "uuid": "9c48a232-4564-4885-9b69-1820ea918e31", "comment": "Malware payload", "value": "688b23dd1aca54f181d804dc91c36501d35a4456", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809127, "uuid": "637814a3-4753-4ca5-8c44-b74dd5470dae", "comment": "Malware payload", "value": "b00411ebd6c4f399d53fd86652118c88c44354489cb53f1e8d427b7bda670fa5fca7bae48d2008ca2d89b65f43e6bb3e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809127, "uuid": "42b8f77c-5c1c-454d-b08b-e0a6649c38d4", "value": "T103447D09CD1390B7C83712B24607F6EF56B2C761942599DBEBCE2DB8DF22A61420D7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809127, "uuid": "f7252b40-73a1-4542-8d48-cc6e8176d7d7", "value": "6144:BJDkkdcgDs2h2z53yxkh2SmT6NO3zkPHZHQGJlsko2S:BJkKwWdxkh2S+6NKqHZRlsH2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638809127, "uuid": "3a926620-c7ad-42b0-b4e1-94078696a03f", "value": 273413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638809127, "uuid": "db2bfed6-2602-435b-a30e-eacebd6bc3aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809127, "uuid": "7710d7d4-2f47-454e-a251-159fb7166aa2", "value": "f7d8906479880474416d41e1993cb141.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b75f4d-565d-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638772157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772157, "uuid": "8d1ce058-7e64-48cc-adc6-c3e9cc0e766e", "comment": "Malware payload (CoinMiner)", "value": "84bc5e264f5d9f894b7f7c3e8af39721", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772157, "uuid": "7d82254d-2878-4cb5-a227-67fd65433e39", "comment": "Malware payload (CoinMiner)", "value": "d8af26541263929cbba975eff6cc79173eae5fb97f05e8fa36297ba83c6ef2c9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772157, "uuid": "e3785129-e1dd-49d0-a58b-cb9fa2c39df0", "comment": "Malware payload (CoinMiner)", "value": "71c23342f56fd45fc9e3979b0e17304ded0a6af1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638772157, "uuid": "e0164da3-1ab3-4ef9-9f2d-e96074823680", "comment": "Malware payload (CoinMiner)", "value": "a4ad48d313f674d09655e869be7d322dc8186a6010144de5e9043a3464a3df9bfe795c77f9222e656802117f11849ec3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772157, "uuid": "cc52f223-004c-4971-b024-d02e8604ffc8", "value": "T11AF2D196E1E91C49D2A616388CA37B085822DC25A6890B6F1FC4363FBD733F47D25324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772157, "uuid": "9a5540c9-d98d-466a-8a04-c6aef24d67c9", "value": "3d2b95b998469ac775106242f347c0e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772157, "uuid": "1876d47b-5b02-47b7-9652-4a060ff4db92", "value": "768:Mw/iOWTK3JWhOM/qZh7UJGcZ/tx1NBkYnbcuyD7UFRAj:zQK52fqZSIAnXGYnouy8kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638772157, "uuid": "6409fcda-dac0-4435-b08c-329f48c3ee0c", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638772157, "uuid": "d6989c13-8911-4c54-b222-d0355294f2cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638772157, "uuid": "96bf55ae-0848-4bb3-8d0e-ec4a5dbb1dc9", "value": "84bc5e264f5d9f894b7f7c3e8af39721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6074b0d8-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1638808895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808895, "uuid": "203f16ef-1ffd-47f3-9290-f1681ca038d5", "comment": "Malware payload (Quakbot)", "value": "7899643f4730909542c3a5282d04c280", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808895, "uuid": "28d09a0b-60f8-4ff9-b292-7873786573d3", "comment": "Malware payload (Quakbot)", "value": "d970c4083bacac19c7078941f5603bcfaa93a941836400bc7259d70db65c4ba3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808895, "uuid": "5b415a26-fe42-45ba-a6b5-2fcd1cba3502", "comment": "Malware payload (Quakbot)", "value": "99d316e033e2a980c476381b458a1d50d9517c72", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808895, "uuid": "9e7c6056-3430-40ba-a36e-f3b06ae1fe2d", "comment": "Malware payload (Quakbot)", "value": "2579d46e540915e89aa8735a5eb83a960d8c14251a82fb7b6f08ff1c1fdd1a1426dc1f69ac03beebc64ab2863b45b454", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808895, "uuid": "6139b89d-a93a-4a16-ae76-743442a416cf", "value": "T1D7530269E0B0056FD76520A22B3C5487BDCA4F7E5AE13AFEC5020A92B5956CF41D0F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808895, "uuid": "71268e43-fd92-4631-a8c6-04d7254091bc", "value": "1536:TMGAHWtrsea0KRxAPZEc4CuzWpji50rRt8Fdeg:TMGJzu048Iwbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638808895, "uuid": "a27e1b89-98ae-41ef-bd35-329025fb42d6", "value": 62104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638808895, "uuid": "38a77f20-815a-4902-aef7-342541d5ebfa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808895, "uuid": "ea4872ef-4cc8-4f15-84cf-d5d229f1013c", "value": "q-2377536609(2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89933114-568b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638791785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791785, "uuid": "ab2d368a-c4ce-450d-b53b-950350006b49", "comment": "Malware payload", "value": "32e3cffa47ff090fb196be8d47255c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791785, "uuid": "efb46481-0b0b-4264-a64d-830a0b5a87af", "comment": "Malware payload", "value": "da1bda74e2844a3a782c6e23d9a410166d028583298aabbecb9e7553eb6cb517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791785, "uuid": "96a0683f-8957-4e7c-9540-25cfa39668e9", "comment": "Malware payload", "value": "887d5b4ad01b21c9f44aed2a281242cbb6878e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638791785, "uuid": "dbf6573f-d128-46e3-9c35-2841514fc915", "comment": "Malware payload", "value": "290dfa67b0f225c085869294252c8691eacd49fb6166dca86ca1865c85160e79fd12e2108ec8d74ea836ce6f9e1540d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791785, "uuid": "9d5bbc8a-4c57-40c9-b8fb-ae2256b104f4", "value": "T1C4F42367BBE3C892F46785B400B2AB1EF3765510261106FE23A4935DF26652B0E3CDDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791785, "uuid": "85e3b145-e201-459a-9b79-463aafd805bc", "value": "e993db4f819ff0a3121bf9c6b6c636cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791785, "uuid": "d4143a81-0e3f-4ac9-ac99-b4ae178e533c", "value": "12288:fhO4sMmwSexr4Jv2hfxBMi84JtoAanVMuz7TbYfvHAZAw6K3buQGhGTNv:flD9S2xxBRGvzX2Hw3uQlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638791785, "uuid": "f5d3038e-6a6e-40ac-b0c7-3bf7ff48d3f6", "value": 739029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638791785, "uuid": "0b202110-4f7d-4b4f-acbc-6eb0dd8c5e1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638791785, "uuid": "2c76c267-076e-45dc-889f-73ed44870eaa", "value": "WinHex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8050c480-56dd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638826988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826988, "uuid": "cbf7676a-42de-4c9a-bc9d-4c44716bd2a6", "comment": "Malware payload (Mirai)", "value": "105b1440a079851bc686b8e98daf0ee1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826988, "uuid": "b130b2a2-3f9f-4cf4-be89-d2060ca98df1", "comment": "Malware payload (Mirai)", "value": "da3efce2a449514113733422cefac322ffcc326435ef101b6952d7bbab319585", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826988, "uuid": "caa8a423-c83f-4dc0-9dec-ef4f46615c40", "comment": "Malware payload (Mirai)", "value": "a8fbd738f4d0387168ebdae44ecbf8755c9c2aef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826988, "uuid": "4ee06df0-ccfc-48db-8e70-88ce3cccfa0c", "comment": "Malware payload (Mirai)", "value": "32c814e4499d71f81e9582c2255be0b01cb05adea2e9906ab2f9514359bb7d207e08bea310cc9338cb9f227c8d923b2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826988, "uuid": "7b4a9282-25de-43a3-8676-93da6f5e56cc", "value": "T109635BA6F800CD7DF856D77B44130A05B130F2540B921B3BB766FD93BDB21A4A866F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826988, "uuid": "6146c15b-439f-4e09-8b96-391c079c6651", "value": "1536:vvqJXmi+76MJ1vBQpR8C8fjOPiizFrr8DIvGKzCE8:vvqJX3+GeBsR8Pixr4SCE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638826988, "uuid": "d480fac6-c8e1-427f-b5fa-732c9f5ffd98", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638826988, "uuid": "5e4121a4-f63c-4559-9fe5-ebe22af0df4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826988, "uuid": "e4837667-5d47-4bc5-80c5-b06cec87cdaf", "value": "105b1440a079851bc686b8e98daf0ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78957f9f-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638765127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765127, "uuid": "98254713-3cb8-4be2-82ab-5fe81ce809a3", "comment": "Malware payload (RedLineStealer)", "value": "5d189e938902eaae6f0f249af89acaa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765127, "uuid": "06e65273-b1e1-4dbd-9123-55fafa72b1e3", "comment": "Malware payload (RedLineStealer)", "value": "daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765127, "uuid": "c407c216-e191-4df5-afd9-145fd128b277", "comment": "Malware payload (RedLineStealer)", "value": "b8f481af1a86b28c904df2cf56ca54f92da8112b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765127, "uuid": "87ba33b9-1a53-4b1c-97bc-f4e66e168ca1", "comment": "Malware payload (RedLineStealer)", "value": "e627b5cc8c81c2f570f8b0e3c59fda82cab11914b2359d5b926073c9b1cf594e288d91aa5c09f15109c7710313e33ca3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765127, "uuid": "7c38cb0a-eddf-41e1-82c5-a08ddec5fd08", "value": "T125257C29A2F1BE29C3D66637C029C45096D2DB442663E36AF9FB12931F4F3B10DDA1D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765127, "uuid": "af27684a-5ec1-46b9-a68d-6ea15e5cb35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765127, "uuid": "ad57c18b-1fff-4842-9963-d20c5140ae88", "value": "12288:+6FePODGuoYPQh5mfeWVJeNYURZLlefS+YncT23GaUeDH4+D++m8:NFePPGf1SNrLMscT+GLefm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765127, "uuid": "c2999133-fcc4-400b-9db9-5ae9c87d727f", "value": 1021672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765127, "uuid": "304c5af5-375b-48cb-889e-59a212df87cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765127, "uuid": "076e02dc-1204-4af4-a6b8-8a8c70b64cbc", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73abb9f-5678-11ec-96a4-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1638783674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783674, "uuid": "1cb3175b-36f5-42c2-b1c9-edd8755de331", "comment": "Malware payload (AZORult)", "value": "e0b38fd090a7203b08317fb27b923cca", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783674, "uuid": "d5ea30dc-1f67-4e72-9872-f42b707d289d", "comment": "Malware payload (AZORult)", "value": "db17966433630a4e75bb1a4e9aa3ebe3b9fb88e6a4fbd32b6ab4564e0af44466", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783674, "uuid": "7d237c46-e6dc-4181-b1a7-9844e73eb91d", "comment": "Malware payload (AZORult)", "value": "daf0137ffeba8d635ebf2dfe852990d667c0f7ba", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783674, "uuid": "ee9b47fe-537b-42d8-aa98-73673c6eb92a", "comment": "Malware payload (AZORult)", "value": "383ae3d81400111643b5d00c79d8ccdd8d655903c3175d145160bdbebe224539c0155edace3c69ffa37d6a319c470572", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783674, "uuid": "4dbdd0c9-3ddc-47b1-917f-e8e9a321d875", "value": "T10341CE2107F5130CE7B28A3DFCB3E310D672BC22E956CFAD0240505468AA211FAB1F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783674, "uuid": "0b3a9154-5627-469a-84f7-507fbde282e8", "value": "24:8WeHE12OUsTjlzC+pKiWmMAtWC+/CWvnLIHi2/Fefk4o0aYrabVIJ0wm:8W6mGeqLT8goOraR20w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638783674, "uuid": "ea7d3ed3-4204-4a66-806b-a9dd4e10bc97", "value": 2329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638783674, "uuid": "20ecb078-7f38-44e1-918c-2513b71ac16f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783674, "uuid": "7e366273-33a0-4168-96b4-3f157d407347", "value": "Image051.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13da5437-56c1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638814780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814780, "uuid": "eac26715-d59f-4a77-82bd-54f360ad128f", "comment": "Malware payload (Dridex)", "value": "7b4c9957c8fe2262e09c00845ead7aa8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814780, "uuid": "cc9a1d40-83e8-45ad-9b54-eeda19430f6a", "comment": "Malware payload (Dridex)", "value": "dbe358bd92f4d97dccc73e246360965cca7f1be23b998a232c3ea92021cee572", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814780, "uuid": "7f4dec34-f086-4cd6-88ea-1ab47029ec94", "comment": "Malware payload (Dridex)", "value": "e8a2eae199f1a71d479b97463422e7bb8f2c6640", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814780, "uuid": "45f72ff9-f8a1-4403-8a8f-e3a490e44609", "comment": "Malware payload (Dridex)", "value": "8d5443ec3a50ff82d5eda4c056b699627d588e1f2cb69f1f74a9754e6208a4cfb5e90b330873bda2fd4aeb9917c2924e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814780, "uuid": "f6660bd5-f9ca-4c4f-80ff-bb3bfd9a7f43", "value": "T11BF3128D7C7A347EC1D80E3D59094AFA91821B509DE6666B08EC3A3DA791F63030787F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814780, "uuid": "5c0663f2-9fe0-4b20-a9a6-3559c4e4cf84", "value": "3072:/f7zQjpD+ztFdOk4gBUYKdbm+QcI3W08+d2nYFn6ArhyndHc:X7zQjR+0eqYLm0JdcYFnjed8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638814780, "uuid": "c15ddc99-45cf-406c-be1b-c45614cf5152", "value": 162034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638814780, "uuid": "f20a2399-6909-4dec-b3eb-9ce3b1837e4e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814780, "uuid": "2c2185e8-8d03-4359-befb-eb784dd36adb", "value": "insurance turnovers9270646.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbcf8a5-568c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638792406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792406, "uuid": "d90a0eaf-ab75-478d-a56e-fcbce92da2e3", "comment": "Malware payload (Dridex)", "value": "9669d28c903a6b096d9d2452b14fc4c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792406, "uuid": "e0b01a0b-c01d-482f-93e4-37c260e68a12", "comment": "Malware payload (Dridex)", "value": "dc764bcf7c82b8e21be4e6ab57217dea8edce6259c724f5605546e50549a2b99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792406, "uuid": "c970cab5-e3a2-4331-8f3a-613c50e82c7c", "comment": "Malware payload (Dridex)", "value": "2f6e28dd7897db2cc297c832a7dc9965c721f1ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792406, "uuid": "bc8ef45e-a030-4aaa-ac87-d124968ad3d1", "comment": "Malware payload (Dridex)", "value": "aa69ced665e3443f228c4a6608025b83375d9d21c1eabb1eeba8795cde27b34da1101fb5fa1e1e4deb618f1d2f7f29f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792406, "uuid": "246e6d1e-507d-44d9-a35e-801609cdcff3", "value": "T13533D892B292E80AD95917394CDBCBE63736FC116F57838B3285F72F2F716C08A02516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792406, "uuid": "e60c5601-c4c3-49dd-a737-f07daedbd731", "value": "1536:QgSk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlR1XxyY22FikQmX6VI0:LSk3hbdlylKsgqopeJBWhZFGkE+cL2Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638792406, "uuid": "7911b7f9-27ea-48a3-81b9-53944b37db2b", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638792406, "uuid": "33df76ca-912f-4511-a874-e24e61259fbb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792406, "uuid": "169338e4-7e79-4b4c-a396-cea58c868974", "value": "Statement of Account as of 12062021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bc4d6a-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638760423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760423, "uuid": "19a7c5c1-f737-47ed-b8e3-be26a7b1001a", "comment": "Malware payload (RedLineStealer)", "value": "3034cc73cbdb9c357ad40acfb7713d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760423, "uuid": "3b3708ad-9719-48fa-85a4-3001a7250689", "comment": "Malware payload (RedLineStealer)", "value": "dc795428161f80791ebf5776f3ccace87d641a77a91be57a18a4833383881eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760423, "uuid": "0f81d9f4-5021-475c-ac05-1d6fa6013f7e", "comment": "Malware payload (RedLineStealer)", "value": "ecc5b0b5545ce04416dfb73a65d1380c1653cfae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760423, "uuid": "8dc81b45-9b75-4a13-9e97-13c9e8d4f326", "comment": "Malware payload (RedLineStealer)", "value": "3d03dfd46d0be2ff606f52e3c87d26e163014c6461d1e8cef7af3aff5938deafab92562fe996240b1ca656fa8654ccdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760423, "uuid": "7960b26c-f8b1-479e-96b0-9dc64c5ed29c", "value": "T18DA3295437DC8914E6FF0F707CB0111883F0E5A36412EB5F4DC564EA2E66B81AA66AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760423, "uuid": "47c49ff7-2f55-4217-94ed-698942e12dcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760423, "uuid": "00afb97e-df41-427c-988d-a49135b2000d", "value": "3072:1DXDD4w3wRejbck++2zQ9+zLLLfLzP3NaI9vkK2:R40wRejbc7/S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760423, "uuid": "de394f28-6af3-463c-8dda-ca02d38b7579", "value": 106712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760423, "uuid": "c7596bb1-cdb5-4e0f-b53e-1a74da66495a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760423, "uuid": "b85edad5-2d8d-4ec6-a92b-74cade7d7899", "value": "SecuriteInfo.com.Trojan.PWS.Steam.21709.26420.12051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee52f54-56a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Alien)", "timestamp": 1638801887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801887, "uuid": "4eda7879-67c4-4989-b6e6-ab126e62d052", "comment": "Malware payload (Alien)", "value": "49c385d4cb2dab03aaa55f03090d36cd", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienrat", "colour": "#DD2406", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801887, "uuid": "72550974-89a4-466e-8c79-1d3d5d0f2ee7", "comment": "Malware payload (Alien)", "value": "dcb44dcc682dfe8ac8582125fb201c583809c12f578e70eafd6c37de3cf06f86", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienrat", "colour": "#DD2406", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801887, "uuid": "fb77e69b-a99d-43b0-8cfb-7bcd1f46f127", "comment": "Malware payload (Alien)", "value": "4cf09ba61dacbd7185a400d37137518928a22cb0", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienrat", "colour": "#DD2406", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638801887, "uuid": "ae45a94e-9f29-46cb-afe2-006ff843e72e", "comment": "Malware payload (Alien)", "value": "9af899cba408e0342b41668be11823a7dc5cb8d51464771e9602dab89bd90ea034e120b4b6f3f53501676f5df405d0c9", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienrat", "colour": "#DD2406", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801887, "uuid": "b5735dbb-91ce-4826-8ae7-9adb766f64d3", "value": "T1419533A3F7402572F2B6D231675F15A124BA6C3A225EC5B5709FB9214BB3F204F6EC21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801887, "uuid": "a42624e2-abca-449d-9e81-07ef5b0d15ba", "value": "49152:wsGB1HNjLAmSzCFm2cXEF3rSFHDtghZHV6XUtUfd:CBjjLN5Fs0MRMTUfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638801887, "uuid": "6e7aff91-0ad8-4b2c-b3df-0eb87e1e0185", "value": 1933593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638801887, "uuid": "b47a168d-bd81-4f95-8bcc-b130e6ec379f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638801887, "uuid": "e4049f92-35b2-4a72-a985-df098cc9bab8", "value": "bundle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9451eab-5695-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638796160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796160, "uuid": "8a33bf07-9e87-4bfc-95a9-87d14b171c00", "comment": "Malware payload", "value": "b88edff35476e834e8d3e6fa2231fa49", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796160, "uuid": "e9f7bb89-ae16-47a1-a28b-e502134e76f7", "comment": "Malware payload", "value": "dcd0ae1ebe476d571b42d0390a71a28935b9485e49b45e6a3401903eaca1eda8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796160, "uuid": "2e836859-001a-469b-9c06-898b8beac714", "comment": "Malware payload", "value": "0a474357aaf568d3ae8f17534721f59b92c4e26e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638796160, "uuid": "f6a1a525-0bf4-4ae4-9faf-c17de1972399", "comment": "Malware payload", "value": "d74a9e5c319fbea143380b9e40e5e73c9612fe6f1480dcfc95f6a09ce44b3d5e39a60032a7add463cf38e61bab6a622b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796160, "uuid": "5eb7cd92-b57e-4617-88c7-5598a1bd7790", "value": "T12164AE1276C2C0B6DAB311B18656A33EB3F6A600473B69CB5BD51C205B355C3E73EB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796160, "uuid": "8e439906-5679-4fd3-b4e1-027e702c9037", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuU3rNOW1V1d71:WKEUkuAOLka1miSmuYr1V71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638796160, "uuid": "c6617326-b07a-4569-a9ba-249290b264eb", "value": 336831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638796160, "uuid": "6b3a007e-5537-4e24-b61d-73ebb1e098dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638796160, "uuid": "895374cc-8feb-47fe-8424-8c4dffc79f75", "value": "emotet_exe_e4_dcd0ae1ebe476d571b42d0390a71a28935b9485e49b45e6a3401903eaca1eda8_2021-12-06__130915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf7d929-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760382, "uuid": "f09d8b34-f463-4693-a909-1b414da2a4ea", "comment": "Malware payload (CoinMiner)", "value": "73073649b02ccf2809aee7713ee72ee2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760382, "uuid": "577ba303-037c-4a78-a53a-0d060af77b74", "comment": "Malware payload (CoinMiner)", "value": "dcd20edf47f46b27c1b81cf03d18dc00aecff1d1eba9f0a0e55e1182f4a2f0b6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760382, "uuid": "80154f49-0758-407b-89d1-80e69dd70d10", "comment": "Malware payload (CoinMiner)", "value": "b724c23ed90ddf15412aa917d87422274521e48a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760382, "uuid": "6dfc25e1-b696-4e23-89b8-f7113859d479", "comment": "Malware payload (CoinMiner)", "value": "f5a40a728085161b9d407c58e22b2a5f61c532472de484b140799115ec7f25d46e829699735a187e626e6c3f47fb59ee", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760382, "uuid": "5b16cdd8-1ec3-456c-a1fb-c4569399d488", "value": "T17EC3129F27A13F1BC27D9C74E435B901BA6EA71123A737B9054AC7E3BC20169806B256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760382, "uuid": "1613d5c5-41ae-4525-bcd0-af7f88574961", "value": "e7decaf25f40094b75c326b377323c79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760382, "uuid": "03615597-5952-466b-abc0-0d11b37ac6ed", "value": "3072:pI6HWPZM5pwiEr4O1cy/055JoVrYDezjtEUMEjZ4Y:i6sZM86OwLqrYivqUMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760382, "uuid": "8c7538ee-226a-4ae9-96c9-0cc52c91fc01", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760382, "uuid": "ff11f2f6-423f-4bb4-b699-269264f1b10a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760382, "uuid": "cc1e1d7c-9898-405b-80d5-6b119c0395c2", "value": "SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9126ffcd-56bd-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638813272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813272, "uuid": "def219ef-12b4-4a6b-beac-23cf37242b43", "comment": "Malware payload (AsyncRAT)", "value": "88bf9b66d872ff9b0ea02f67c18318c7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813272, "uuid": "6577c58c-7bc9-4cdf-9b4e-49c5340e65a4", "comment": "Malware payload (AsyncRAT)", "value": "ddf0fd6cd9d3a863c6f47d5e6e5533418c83d45a4b10cc7283614d03e276e608", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813272, "uuid": "9e51bfa0-f3aa-41a1-848a-815819944f2f", "comment": "Malware payload (AsyncRAT)", "value": "e99dc21330fba50d1290005c8d0a825b8574b11a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813272, "uuid": "f6fb7ad7-1a77-41ff-a02c-d2f5a034185f", "comment": "Malware payload (AsyncRAT)", "value": "d1d2bdd2c9061ee38a2fde24bbf306008bca06839bde33447ff2203d73923d8148a7abb2af0f6015d643e2d16ba049cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813272, "uuid": "32c63946-88a4-42e5-be13-92f8c65e2fbb", "value": "T16321BB3ECA9B11EB0F5DA17652D59DA080F0BBA5D1DAE1A070B047DF90FE82D46B904C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813272, "uuid": "255cc3a2-b264-4b41-b573-93095be96f86", "value": "24:GTTTTTTTTTjD3fi1lSGTiMSWQAKQey3lgGt5n13QKBLhQAKpaVUsaO:GTTTTTTTTTjD0cGTvSWQoe2l51QmhQRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638813272, "uuid": "5bea071f-56f9-4ece-8fd9-aa78a9a990ec", "value": 1430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638813272, "uuid": "a1974ac8-cf71-4227-98dd-3e63e7ca5f2b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813272, "uuid": "78eaa50f-34f9-4745-a0eb-39e8c7a93d7e", "value": "WQGMJ563650.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0b948f-56a5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638802902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802902, "uuid": "0637c818-0255-48b7-8220-8dc0bd3f49b1", "comment": "Malware payload (RedLineStealer)", "value": "966a36421453083220cacc8d6aaec9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802902, "uuid": "35c03953-8e0c-4c6f-af8f-fed236ec09f3", "comment": "Malware payload (RedLineStealer)", "value": "de0aff987e82adb3cd7972826735b5a0596f563969c26be70bf472527a8a3d58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802902, "uuid": "830a125d-ed22-47d9-9812-4ce28dfcf207", "comment": "Malware payload (RedLineStealer)", "value": "5da9a14c572c2d6d3d3060bc132af5428741bf49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802902, "uuid": "052e2a41-08cc-434c-b98a-e33d595b1b98", "comment": "Malware payload (RedLineStealer)", "value": "a6437a737bc141820305f206036e8a8c287ac799afbf9613041ce26c15afdfa4e777b1115d19b1c9ee9ec55a47541090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802902, "uuid": "c95ccfdb-bf4f-49bc-8887-3078fb8d9d38", "value": "T18144AD1233D0C432D09328768825CBB54EBBB4755A665A8FBBD41FBD5F243D1EB2530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802902, "uuid": "6bedd821-0e49-4f36-b64d-b59b7c908b8f", "value": "56620115eb6e0830bdf5b4ae97062a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802902, "uuid": "ed7d1667-e08e-4cea-ac67-5adeb3a9d5fd", "value": "3072:UqThou1EuQDcm1jT9Qo6SKJiFzQgAGWQnhRfyBCBoWzRrmPSjgV59d:7Fouup1HECxvnhJyBCBRKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802902, "uuid": "053e10d1-80d0-4c72-96a1-a2946b057e05", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802902, "uuid": "8387c07f-762d-4c96-a9fb-2f2dd1d9d728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802902, "uuid": "b0c41992-4ba8-4fe4-9147-93f263010efb", "value": "966a36421453083220cacc8d6aaec9c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4b4b34-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638765135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765135, "uuid": "aa6c29fc-6112-4fee-bdef-10a350489702", "comment": "Malware payload (DCRat)", "value": "a499542c590e4a035959f42dc5967543", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765135, "uuid": "0b3eaadc-bf8d-4188-b248-a879b40bfcb1", "comment": "Malware payload (DCRat)", "value": "deeecbb5e974ae80698d8c8cc00e1d6f5bc3e4dbca159d435ebff59c19dc29dc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765135, "uuid": "57b5f6ee-fa3d-4953-86fb-4aca05c4b43a", "comment": "Malware payload (DCRat)", "value": "765e5ac642e928f0e494d467bf7131f45a0367cb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765135, "uuid": "47fc2bd2-8e5e-4a0e-958a-2cdb311fdc02", "comment": "Malware payload (DCRat)", "value": "448dbe0942ac22085d5677e87392897fc9e131c18c9244d132272dff82dfaf9bc7cefa3f02c1b3ea90143e226ef36f4c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765135, "uuid": "153f1f83-72e3-4761-b7ad-59e5baa7827f", "value": "T1D665338A3BD12724D01EB038A9A14D47587F772790E4DCC339AB27143BE64AFE3516E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765135, "uuid": "f755f060-1028-4738-98a6-4bf12cab7251", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765135, "uuid": "ea2fb6b6-fc37-4411-b89a-48b0e36e617a", "value": "24576:9XteZFicAtIKuTh3qP7nCzb9Qoja/SWBJ2mppleXJuCESnTkEaHNYK311ZOeQq:9kZFiGKuNa7n6RQs+ReXvESnTNazPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765135, "uuid": "cbed2600-5572-4b5a-b463-ebbe5651102e", "value": 1542088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765135, "uuid": "7b26f654-782c-43cb-85cf-796c5bbf56f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765135, "uuid": "4ad86c84-39fa-4ef8-bbdc-f9cb3f85bc9e", "value": "SecuriteInfo.com.Trojan.DownLoader44.9846.13413.25757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b616955-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638765132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765132, "uuid": "30b07a17-c2fd-4f40-8994-90c504f0bb6f", "comment": "Malware payload (IcedID)", "value": "797969fff63bc27ff47c02212685e027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765132, "uuid": "6cf3c19b-56f5-485c-8499-245880218948", "comment": "Malware payload (IcedID)", "value": "df16de6120e58e0576c0af236154fb9efbcc3a1bde4dbf6078b3e7d94d17fce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765132, "uuid": "d03aa8fd-81a4-49af-8293-134a3b72eaa2", "comment": "Malware payload (IcedID)", "value": "8dbb347120bdfffbb4eec3929d323cc6ed42698d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765132, "uuid": "4e5cf17b-8fa6-469c-b0bf-1283d3c7b4eb", "comment": "Malware payload (IcedID)", "value": "9c4ca91041e97a6e82d47f9edb8fa5fdc5b0f53c7940586e00d4a8a0b38d5cb30a6dfb3c311fb09a410e60b537b5c6ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765132, "uuid": "c1e79718-4681-48f9-83a5-e0258348b0e9", "value": "T1A6844B18759CA9F8E9EBF4300BFE72979253551601F88A66AF91059C4F8F0603DE3B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765132, "uuid": "fbe3f453-bac1-4802-952b-de861f684543", "value": "7b022a136bdc81b7cac489366701d29f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765132, "uuid": "10619664-a51f-48c1-9b32-36c33b584557", "value": "6144:JE20Ot01kJszTKzBA+Dg+ks40sQ/2CPyQrhORoe5oOzObxl7xggu:qct2kJGiA+Dg+ks40ogrh7OzUxlmgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765132, "uuid": "af61b6a5-515a-45d4-94a8-fb26845d70e2", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765132, "uuid": "7d31fb66-9807-468a-9e66-136bfb440cc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765132, "uuid": "7ed4226f-87b6-4c33-b470-8a2cb787ec93", "value": "SecuriteInfo.com.Win64.BotX-genTrj.19379.29922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a82101-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638782376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782376, "uuid": "0aa91b0a-3454-4b9b-97c5-aae551281178", "comment": "Malware payload (AgentTesla)", "value": "bfd47a52e406d11367b2ce2ddac3301c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782376, "uuid": "8a83e90e-3c94-4ec8-9de7-f3363db1e678", "comment": "Malware payload (AgentTesla)", "value": "df21ee835f6c3aff5d550ef9be63f198e349a35064c6fe1864e7dd5eeb5e1303", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782376, "uuid": "2b19d221-d433-4d14-926d-797578f7b50e", "comment": "Malware payload (AgentTesla)", "value": "e2057748090aea60aadca78edbc997e512cdf60b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782376, "uuid": "79e51899-34ea-4f42-9c2a-6b6f9eecd599", "comment": "Malware payload (AgentTesla)", "value": "04073a114438bfbd9c5fb4ea42aee7b5065fe68f73639f902d383db7ed96cce8767a83cf0c95bcb3f3575e7a96b0343f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782376, "uuid": "98754768-5c22-4319-8d37-37949cf76604", "value": "T1D6557A2D21B5486BE97C1A341425473B8EF26C3D99B7E3CD3748356F4BB26840A263ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782376, "uuid": "2482d915-1ca2-49bb-984d-0a0fd8a126bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782376, "uuid": "b9993bc9-a96f-4704-941f-3ef3e5553fd6", "value": "24576:7kzbx9E2fyxTAr+vJGxtueAh3WmnSRA7rE0Y9kZ4G38L48tdKVn3xnxnYNBLz:732aA9trY3WE2WBMLoBneBLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782376, "uuid": "95f96712-b639-419b-8310-2b25ff56b127", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782376, "uuid": "2d266071-293b-4abb-948f-4eb12645da45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782376, "uuid": "174260b0-d2a9-47b6-ac74-46c8dd8a87b1", "value": "Orizzonti s.r.l. - Quotazione.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53e2d45-56b7-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638810836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810836, "uuid": "dcb09dab-e995-40b2-9a79-31efeb69ba2a", "comment": "Malware payload (RaccoonStealer)", "value": "18154d43672289a23668499bd73089dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810836, "uuid": "7ae49ea4-12f3-4c2c-b933-2e9cca02bd9c", "comment": "Malware payload (RaccoonStealer)", "value": "df6c5bd3440d744b7aa2b89a600f623429ab35f956d7b33d93a402c4d1a84828", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810836, "uuid": "ed352c3b-954b-4050-a1c1-8515ecd52279", "comment": "Malware payload (RaccoonStealer)", "value": "8f2be53102f4e39a43bc4de6d6995509428f3acf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810836, "uuid": "b8576d2d-9a8d-42e7-960c-1fa015518973", "comment": "Malware payload (RaccoonStealer)", "value": "57621d9bc0fff34552ae3bf72f3ba4979b8193f6ed8e97adefeadd79f75fe38a4b6117265de421355ac307b4defdd2d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810836, "uuid": "2ed88d27-b0bb-4a65-9c86-143a043a50ad", "value": "T107C4F11232C0C032C05731755625C7B45EBBB4751A6B69CBBBC42FB91F24AE2AF36729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810836, "uuid": "1e36fd62-8bc3-442e-93ec-e7d277c5224e", "value": "6c355763d97257cce28120024c0d5f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810836, "uuid": "c872f53f-dfa9-4b9e-b225-bdfbfd0ab0dd", "value": "12288:XqmI3LQpISh3wQuWGnqApQVGZlabgfRlluNpcCQZsq:Xy3LQp3hghQAsRbgfroNmCQeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638810836, "uuid": "7882e542-aeee-445d-ba87-86acb2bc82c8", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638810836, "uuid": "19e4c54b-1a07-40c8-9f66-5e8284547902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810836, "uuid": "21675e05-2a6d-4d77-ae85-afb1738c6c33", "value": "18154d43672289a23668499bd73089dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539c1144-56b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638811021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811021, "uuid": "57a6e904-6432-4ec6-bed3-7ca2598939b0", "comment": "Malware payload (Dridex)", "value": "32e3d3ebeccd3df67c9a1ceb55e771db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811021, "uuid": "8af2aef2-7f00-4f8b-837e-615b6ef336d4", "comment": "Malware payload (Dridex)", "value": "e00e4ae741e549cdec85c6ebde1df9b94bfbd179b49028ea3abe6e9d529f74da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811021, "uuid": "0fdc2b40-2667-4729-91b5-1704ee0217a8", "comment": "Malware payload (Dridex)", "value": "cb04ecfc317604536d101d00b05a20f84d5e36ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811021, "uuid": "54e29097-5fed-446e-b01c-9fd62ef82379", "comment": "Malware payload (Dridex)", "value": "d9d53bdd4e8d2180f5ee97202cc179e3017d9ac66089c97f9be24d5efd48cd53342294bd0e95144feaa533136f9564c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811021, "uuid": "b67799c3-3ac3-4d72-8125-e5fd0f601c64", "value": "T107B3125DC367F0B2C45F017DCB6FB8BD861370625280E1A7600EDB5C0B66A268AB6C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811021, "uuid": "c30eb13f-b54c-4818-b4a3-64030bdcdfaa", "value": "3072:aGNRIKLcuZ91td/fKxSKREvpER3yPpIMoMG64zp2kxYdgx:3iKLcMCQBI3TMoMuF2kxYdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811021, "uuid": "79f7d057-abee-4590-90ae-046f2a8bf176", "value": 115704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811021, "uuid": "144776da-976f-424d-b3ce-e291353f1fe2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811021, "uuid": "b71cc9a1-eadc-42e9-b3be-57e22f997669", "value": "act corrections12-2021-3642137.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2ebbbb-569e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638799946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799946, "uuid": "2884b7c8-5c4f-42f7-b373-dee04bc17600", "comment": "Malware payload (Dridex)", "value": "be5c2a86e8203b713825079b800b6d7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799946, "uuid": "c001d436-760c-4c28-912a-2d75307eb93e", "comment": "Malware payload (Dridex)", "value": "e023351c103b63084b21d7d0051001caab0643fc7b39f2a5b168c5e923af6430", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799946, "uuid": "35a943f9-e3ba-4aa7-a4af-9b57d6e6d787", "comment": "Malware payload (Dridex)", "value": "3394ed014d307d5e8258bcac2dc7136900f42b66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799946, "uuid": "268b4598-9ace-42f2-bd99-809dcb32c201", "comment": "Malware payload (Dridex)", "value": "8c7cd955a8586954869a6aad4f92c36dfd270085fa1e59156ce762040604049e0ee09e0ccd4c64ee018061df1da189ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799946, "uuid": "c61ebada-6118-42f3-b75b-9d6706daa916", "value": "T140A49F6CFCEAB436C411C7F0987793990D352619E3FFE6E0362B9087A7566600A4589F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799946, "uuid": "29bbcc76-1d3b-453e-9c26-92180e7f9081", "value": "5293be9dcc3fe4423188dd90c7dd2d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799946, "uuid": "5a27b5b3-91b3-4c24-b06d-afabefeb3443", "value": "12288:+QG80io88EmEkECG2EGoyEW+DBY49h4oJIH7l0:TG80io88EmEkECG2EGoyEW++HKyl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638799946, "uuid": "61f02495-c0ed-4ca5-b791-da0226a0f118", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638799946, "uuid": "dc72de4e-aed1-46f7-bf72-f11d2d2e4a47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799946, "uuid": "2a00b6d2-9395-4a07-8ba7-be971d1c86c6", "value": "be5c2a86e8203b713825079b800b6d7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4f2cb2-56ae-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638807009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807009, "uuid": "9af3b3f8-a902-4fa6-93cb-44424f2bf913", "comment": "Malware payload (Mirai)", "value": "b3b9bd1046fba25dfc1525141f130590", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807009, "uuid": "3d9e1168-f2cd-43a0-8318-ba28ec1f241b", "comment": "Malware payload (Mirai)", "value": "e0dbde71409c8717726c124707c501843c26d6adf2c3b649fec099dff3056d5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807009, "uuid": "b2258b67-f1e6-40c4-80e2-69ba4afec63e", "comment": "Malware payload (Mirai)", "value": "de7d67599ed81eb3fbcef281d2dc85508ef06204", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638807009, "uuid": "18b1ac9c-7bcc-4169-96ff-1116475e498d", "comment": "Malware payload (Mirai)", "value": "7e1ea195e692dc05e328da0a637ba99b1ed0317aea4c8e36ca023dada0af2c4ae4249c7f2b2978966b61387759a962b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807009, "uuid": "216eab53-14fc-435f-adcf-f99b9defa4ff", "value": "T1C1D20845BD829D07C5C94377FB4E028D3B6523C8F2EEB213ED153F56E68E527099A0A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807009, "uuid": "01bef344-8573-402f-9e54-dae457f69bf3", "value": "768:gqXvusczs7fSTWjdSwfqAIyw94RTHwbZn:PDczIfRjo8R+6LwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638807009, "uuid": "29d7c15f-5aab-42c3-9652-527dd6c12eb2", "value": 30744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638807009, "uuid": "0843f9e9-4eba-4811-98c4-8431f2fc41d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638807009, "uuid": "15d38f3e-7a3a-4c18-948d-b912cccda794", "value": "la.bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26688faa-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778304, "uuid": "2520f90f-e3b7-4ccc-8b4b-76a16a663ead", "comment": "Malware payload (Mirai)", "value": "ca1f6c2f53de0251f04ab8df9dc79fe4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778304, "uuid": "122c2b2f-fffa-48e6-aed7-f16a27c462e0", "comment": "Malware payload (Mirai)", "value": "e11a014d3343995f8e74793c6ae074485625a043c74ce23676094a17687b674f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778304, "uuid": "70699b15-38f5-4aee-b18e-98fc3648b7f1", "comment": "Malware payload (Mirai)", "value": "166d97090a91d0cdcb008d785e96e3586e1c1b80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778304, "uuid": "5b00258c-5f20-4c0a-a86f-3bd78cf653c4", "comment": "Malware payload (Mirai)", "value": "c7b405779b3c1cb5f3558f5ed8c80428fd0eca2c2f0e6b1c1b37ec1b8eda957d317d3a4b772a5947a3cf50b4a0eb9603", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778304, "uuid": "dd4296e3-cd35-4c43-bea5-e3f65952440e", "value": "T15D13F12189807E10F3315839C76451E26316467861DFB8AE49BC93B8BBE7B7313F4A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778304, "uuid": "01a57bbc-53f8-4b4d-b1c5-1f2df74d770c", "value": "768:CzPRwgMumtkHmhroddwr/t9z9LkmKWbs3UozYXryIrIxy:2SVAGFpr/Lz1k/zqiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778304, "uuid": "60025606-be30-47ae-8cfa-c37e1fad3e6a", "value": 41676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778304, "uuid": "1cb25a8e-50dc-421c-981d-c41c698133c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778304, "uuid": "5b0309e2-bd69-4cf4-8819-495ba099d37e", "value": "ca1f6c2f53de0251f04ab8df9dc79fe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f0d9d7-566a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638777471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777471, "uuid": "a546d972-8de2-433d-89ec-ce44b18876a3", "comment": "Malware payload (Mirai)", "value": "243c0450824f2b52bd2652a3a15085e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777471, "uuid": "4b84698d-c513-463a-9cae-3a266b806e08", "comment": "Malware payload (Mirai)", "value": "e12893a9faf4f71fc69b14229e337e1992aaa572de17e23ba0f059814441a386", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777471, "uuid": "3e6c5c59-ca86-4999-aa5b-854de8d411ce", "comment": "Malware payload (Mirai)", "value": "15c05697335696e8b0c0141904f3ab6735c55223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638777471, "uuid": "9309655f-b551-4896-adf1-6a4988b17d3f", "comment": "Malware payload (Mirai)", "value": "3786b6e7acffec6296e1d9c2b30c49ba2679077227afe7b0c6083e927779f894585fbf73bf4cd5e4269b9d6f795c45a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777471, "uuid": "a674ae32-65dc-49f9-9c16-6ad8fbe36315", "value": "T132D37CC3FC509F7EFC47E7B6840B86057231E7E00AA24726B6536963B9640D92B17F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777471, "uuid": "38ea2d5e-6b77-417a-837d-23f749ad575b", "value": "3072:k7KCQCODntx6UCuc53z56wZyV7zdvekCRq:Dt3nc5jRyVlvURq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638777471, "uuid": "b5cb0081-d747-4708-be8b-af0c07d68598", "value": 135220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638777471, "uuid": "69758617-fa75-4b85-828c-f03c868e3ef4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638777471, "uuid": "9609fc70-b970-4dea-ae2b-df760611370a", "value": "243c0450824f2b52bd2652a3a15085e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc749e4e-566b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778233, "uuid": "7d0e74db-fbf8-49f7-8588-567eb64f6031", "comment": "Malware payload (Mirai)", "value": "60000d89ed97178dfcfcfbf6cd6037b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778233, "uuid": "23e16079-2d16-48f4-b112-22f0b51a5894", "comment": "Malware payload (Mirai)", "value": "e169660068869e56f92dcaaf584cf7e31420a7e8a0f5d16ddf7bc7a7f8cd8f68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778233, "uuid": "13c11494-e112-4702-a450-65471b0af86e", "comment": "Malware payload (Mirai)", "value": "0a064a3c707fcfb6ab1b225a0b7c721a9dd197da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778233, "uuid": "d6c50f7e-7a9f-4d76-8f7d-c9631bc6e7c7", "comment": "Malware payload (Mirai)", "value": "8b3ab03926a37a05b50babad3efadf623e308927581aea17c820d5205a3e72459c209ac2f2555d6455b33777d186b122", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778233, "uuid": "09566e36-9f42-4a37-bd07-712d50b70ee5", "value": "T18F13F1A7779A26C8D922D33B86CF320E9805A68D918605F255C0B077FDFFF455B1820B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778233, "uuid": "a9abda7d-39cf-44db-9076-4188964fa27d", "value": "768:rw5IjRuhGilwDvGC620jPRfA8LFFgElv0cvfVg1/dZWAEOj4ybGnbcuyD7UHQRjU:rw5IQ4ilwDM20tfPhHMj1/dZunouy8HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778233, "uuid": "57812fc0-1de3-440f-9c78-f04a77984f4d", "value": 44060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778233, "uuid": "6d77fed6-c7c2-454b-891e-9ae0596f4892", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778233, "uuid": "68ab580b-a677-4d95-ab2f-a0d7a201ff08", "value": "60000d89ed97178dfcfcfbf6cd6037b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b48f79e-5646-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638762045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762045, "uuid": "12013b66-7615-441f-bba4-7a5b9c8366c5", "comment": "Malware payload (Vjw0rm)", "value": "800b61af70057adcb5199c9a32800ed5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762045, "uuid": "63ec12c6-e6eb-40b1-b771-64147f520d76", "comment": "Malware payload (Vjw0rm)", "value": "e213b03bb6a8286d026918fbb9bb31a7882e0ee130a469801e53a78c46017c17", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762045, "uuid": "f1719b87-40e1-4644-ac9f-5bf95ea57096", "comment": "Malware payload (Vjw0rm)", "value": "f6796347f1c1344e808f529410687d33c5856a7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762045, "uuid": "90aaab71-0fff-4dec-9091-7081f7babbaf", "comment": "Malware payload (Vjw0rm)", "value": "c2e73e2f8b0f8521db15f8688586f9bb35550d27323112cf8df169675a11353dbec711fe0cc487d829cf8dd49e0b5c42", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762045, "uuid": "d0872936-c916-4d93-a66f-71be5f3b0fed", "value": "T1E9543ACCB890A19DAC259034357AE8C717E4370FD4385789BD1EFA014BA6790E6FE6A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762045, "uuid": "b2412882-59aa-4fc0-9744-105f7e8d3aae", "value": "3072:NMZpiU9xgcgEgGGi+Kg+YzaAvKCYegVOxA8V/ka8GmMhcbi:uIUrgNEg8x8ayKEgGA8qsui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638762045, "uuid": "f46d3893-0a8e-415b-a198-208247598151", "value": 278848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638762045, "uuid": "86785475-670e-4715-a61a-6720c005d90e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762045, "uuid": "5a519fa2-c2d8-4f8f-b881-4c486c00653f", "value": "Swift copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab0aaea-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638782176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782176, "uuid": "15f2c88f-0494-4e8c-bfee-f93bf72079f6", "comment": "Malware payload (RedLineStealer)", "value": "0fb1e42551b4594eed6c95d92c9be8b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782176, "uuid": "9d20acaf-2ecd-454a-9d96-1e1a7b322554", "comment": "Malware payload (RedLineStealer)", "value": "e2566524bc3426344ecf9dd2376f52a25eceede6968fc255028caabfb6f32074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782176, "uuid": "de89b166-7bd4-466b-a8f4-3f8bcfa2dfd4", "comment": "Malware payload (RedLineStealer)", "value": "546926e4939fcc4281ff121a155af358dc428c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782176, "uuid": "7b31c734-8403-4a70-b5e6-d08787eb6161", "comment": "Malware payload (RedLineStealer)", "value": "8571c8d17fbcc18c384ec8c9a7af91cbe662e1c14e95a81195981ea77372d0f801a043cd3e8c55e08d79d0d0c76a96e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782176, "uuid": "1fb67df9-b041-4af7-8603-9915a567e4b8", "value": "T16254AE2133D0C432C59325768925CBB58E7AB4712E666ACBFFC42EB99F247C1A735309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782176, "uuid": "f7a70576-1e77-4411-919f-6cc2304c1632", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782176, "uuid": "b05f898c-15e7-4656-a538-852d9a35eff1", "value": "3072:QJdZzCNSgUh/y7Kwgu39ZF2JiI1vKgTsVK7DVz77D4kVXy2jQH5j5fjhsGT0P:q7zmxNuaZElTsoDVLDzVXAHvlEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782176, "uuid": "2e93a57b-2fc4-4bdc-bcef-1975ca316694", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782176, "uuid": "c11e6e5f-bbbb-4ba4-a9ae-5bc0e2567c40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782176, "uuid": "7fea51c5-c73e-48d6-bffb-168f4eff7f74", "value": "0fb1e42551b4594eed6c95d92c9be8b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827479d8-56bd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638813247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813247, "uuid": "c6684adf-2757-40db-9ff2-1deca950b9fd", "comment": "Malware payload (Dridex)", "value": "784e64bbacb6237e11d886574d0ecfad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813247, "uuid": "aec92703-a16b-4559-8313-04a6a570dc48", "comment": "Malware payload (Dridex)", "value": "e35f91df736a6afea02f76506d20d18e5b175c1d625c4bfd2c3304d446f88bf5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813247, "uuid": "8d0414d0-452f-4134-a21b-35dcfdb72660", "comment": "Malware payload (Dridex)", "value": "93628ffbac62a3b7a5e9004cbc860768d22038ed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813247, "uuid": "968385ec-e36c-46ef-a9e6-6f7a04e069a2", "comment": "Malware payload (Dridex)", "value": "5a1dfb166652aff4b67e1b00521b0331ec54d0e491b657424b0d787e986b020b23d6399bb0547ae82cd5e913ecf5def4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813247, "uuid": "054e3f91-ffae-4cc8-b3a8-d0059b6b5e37", "value": "T1DBF3124EB93B382FC1F10D7C990816FA22816655ADE0906B5CD8365E6793F6B030A97F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813247, "uuid": "814a5cd4-6360-45cc-8836-d00a3df6e4ff", "value": "3072:u1a0W6Jd/wFj3u+N5Ok4gBUYKdbm+QcI3W08+d2nYFn6ArhoCR2dDZ:r0JdYx3u+NceqYLm0JdcYFnj7R2dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638813247, "uuid": "e57d88c8-5184-4786-b219-25a6e0682152", "value": 163534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638813247, "uuid": "6ebb43e7-0e0c-4810-9252-d7944e7806d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813247, "uuid": "4d925ec4-e370-4933-9e33-caf1ae46009d", "value": "64894844162946247.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77c1f94-56cd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638820208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820208, "uuid": "1ff8a4e7-5579-4276-b72e-4dcf2c5e9fdc", "comment": "Malware payload (Mirai)", "value": "d5a5b9aba832ffb90a05229ece41c7a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820208, "uuid": "74c6fd21-2648-43b1-861b-1cd3ac146a32", "comment": "Malware payload (Mirai)", "value": "e46e953ba1c957ab47d02c894bf78a7ce17e8c95d66b435ea7e8d18d12c489dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820208, "uuid": "296a6c16-7db6-444b-87d4-dfe1aa0d49ee", "comment": "Malware payload (Mirai)", "value": "ce1cac9c79b5ce74ddfd990af180f438b50cf8c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820208, "uuid": "6da84e59-a973-4976-a769-fd956ae729bc", "comment": "Malware payload (Mirai)", "value": "1e2093e2e02d0952394ae1d3c20a1465e22e446b7d4a6cc146d67ec41b382156abd97eb64f0666924c9e448c63da59d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820208, "uuid": "80952942-7664-4095-af0c-33309b01c5de", "value": "T1F5D2D07418EB9531E5B097B1DAE5CEC232030B7DD467FE32251207E1DA8230E6ABE5D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820208, "uuid": "435e09c5-aeec-457f-b5f4-2223fd78c035", "value": "768:WXQD3WV1wjry5HfJVih/y79gBWG3z9s3Uoz2q:nD381bHfWJyZgBHAz2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638820208, "uuid": "bc0b0d83-b4f2-4ade-bc7d-838a1640c493", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638820208, "uuid": "1cfca7a9-f8bc-4d47-9e33-fd6d3a1669f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820208, "uuid": "e9b1f934-31c2-414e-9851-48c5b51217ad", "value": "trynagetmybinsufucker98575.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51973a4-5672-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638781147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781147, "uuid": "b42a82ed-3e99-44d5-9a8a-686631cf51aa", "comment": "Malware payload (AgentTesla)", "value": "50cb9240619e806832aaa55f90716769", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781147, "uuid": "1bf93e2a-f064-4cb5-81d4-d383f9b22c8e", "comment": "Malware payload (AgentTesla)", "value": "e48c26f3d971e296f55b0db4a4bc9118deeade9d16cd72a255e2fba8bbfc435d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781147, "uuid": "39e42eb1-238f-4f3e-91be-8a495a97d645", "comment": "Malware payload (AgentTesla)", "value": "c35aa07606b71dee90e913ab771449661299ec6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638781147, "uuid": "7582e00d-b521-43b4-b740-eced61392b64", "comment": "Malware payload (AgentTesla)", "value": "60af81b444df6c99ce727109958b9902e97edf481046f550ddf5d02099f8c2d6ee12d2d70db59e5c3680d3ba082e651e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781147, "uuid": "e06db9f2-2595-43c4-8a4e-80de422293ec", "value": "T190556B5C317025AFE83A853149540F7B9EF12C7D866B53CE7317309B8ABD9468F242EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781147, "uuid": "fefe7ade-5a40-40a9-9530-9d4df410af50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781147, "uuid": "a64c3818-c66b-4638-8db6-5a57f4f4b4bd", "value": "24576:5Mot1vL5+BujDR71iZ8IGAXDnAL7wOsTC+uxgoyqaFI:5rt1vLOuHx1iZBn5Jpuxgoy3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638781147, "uuid": "7051a6a8-a248-4296-a02f-56f3b6e6951f", "value": 1380864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638781147, "uuid": "71237d26-94bf-4e76-9988-fe24fe1e1e12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638781147, "uuid": "5384292e-ea5b-4001-9f3d-5bd1f847b810", "value": "SecuriteInfo.com.PWS-FCUF50CB9240619E.28996.18419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e47d2a-56bd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638813035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813035, "uuid": "f03bb78f-75f9-414c-8922-632c9bb0af1b", "comment": "Malware payload (Dridex)", "value": "c8c40aa81d28f93c409ac38b80684219", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813035, "uuid": "27f01ec1-58dc-4488-9ae1-21faccecdc5e", "comment": "Malware payload (Dridex)", "value": "e49f8b68c3af361ffba2d29f227192bb2bb2ea10132dbdea7f95d408b8c3f7a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813035, "uuid": "434ab892-e76f-4ff5-80fe-f48ad504095c", "comment": "Malware payload (Dridex)", "value": "fee1cfc7aceda3248932aca53731000f86c1e4c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638813035, "uuid": "7a2b3634-bddf-498e-85e0-2358efcf1cf4", "comment": "Malware payload (Dridex)", "value": "4f7bdacc1226d6390bc36e32f70877d7c94812c8f6db2aa11692b253304d84eeca07baa668aef4a32341118cbb91293a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813035, "uuid": "b4461a02-9d84-443f-bd1f-754b85f05668", "value": "T129B3026F928A9E59C09375FD425D1DE5B43544A006C833CB23B89A79637C8D34B2BC7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813035, "uuid": "fea778a2-adf6-466f-9b89-89ddc06fde1b", "value": "3072:3j42uK0gfGf5FTOB1SR4CH2URwHZ1TN7dLI:3jl/WzTOB9CH2EydNdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638813035, "uuid": "d478f936-cb51-4aa6-b4b8-3c4308abc35c", "value": 110814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638813035, "uuid": "8050cd36-8f40-4bbd-906c-39a21cf46e92", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638813035, "uuid": "2010aa57-d51e-4bc7-9b9c-837345ad5958", "value": "065053895892027698765.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ba1c82-566f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779937, "uuid": "97d6bdc5-2800-4cc5-86ec-99efdb2e02ff", "comment": "Malware payload (Mirai)", "value": "ae468305a793afd35c99a0f33c9a4053", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779937, "uuid": "c4f49801-32a0-4f3e-ae0c-afeefbb80282", "comment": "Malware payload (Mirai)", "value": "e4e1c9c6d7b26d63107f65ed7ef6b6e832db8dadaa1f6f49b6987fe8911f030d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779937, "uuid": "b1d9b7e3-da87-437f-9019-1cfcfcd9df8a", "comment": "Malware payload (Mirai)", "value": "2a1f2b91e7a234b81fd83a2eb7f767f13fd70c2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779937, "uuid": "6e438777-350a-4b57-849d-8d2237fdd644", "comment": "Malware payload (Mirai)", "value": "3120a730028fd118cb3baedcfb006b36720f7188977753952e1a77da3a858457ee33d872eca03903aeeb9078faeb8b7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779937, "uuid": "99886267-5c1d-4212-8b74-a2933c74f4ec", "value": "T185D3A61ABB618EB7D81FDE33059A4902118DE19A12D97F6FB2B4C52CE74B94F08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779937, "uuid": "d5bdb920-9a4b-46d8-9063-9c622785a99d", "value": "1536:ppjTTjeTjfP58N0pJl8iqMHZVCnnhjaHqQa6wycdMPcYDxDsdxJ1ZmwJbRK:ppjTTsPqQW8qLOcnYDxDsdxJ1ZPJbRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779937, "uuid": "3445eff5-82eb-471e-b354-fa9ccf848a59", "value": 139641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779937, "uuid": "b747157c-3e62-4d7f-b8f1-5d6978d153d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779937, "uuid": "ff2b966f-dba0-4939-9da7-7d188a3923c8", "value": "ae468305a793afd35c99a0f33c9a4053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52876248-5665-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638775371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775371, "uuid": "98394360-838e-4e71-8d2d-667c515253ed", "comment": "Malware payload (GuLoader)", "value": "2bf595a875a3342a778657f910dc67c6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775371, "uuid": "98294e64-90b0-4bb7-bff1-85edc8eb2132", "comment": "Malware payload (GuLoader)", "value": "e60c05a96f5c6f5edc827693ab6feacc1911e4685e8b02a17535eb8052ef6d65", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775371, "uuid": "fb08079d-85d6-479c-8eff-8c400c9246ee", "comment": "Malware payload (GuLoader)", "value": "23d8168ad4ed27310f1ff55d7115db9e9263f41a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638775371, "uuid": "a3a404c2-09f2-4b68-ad64-0a8277492aa1", "comment": "Malware payload (GuLoader)", "value": "4e7208bb853ee8305f4ffd9d1de32106d2325fc458238aefeb53f3bbb805baeac712ba779745921903e9aa16bc38c32f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775371, "uuid": "8e666800-c7c4-4dc8-8217-1c4173b7206e", "value": "T102E36C216298D6E5E155B7F2DE26F2DC954A6C37781004CB8DCA3BA81B30B53D1EB317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775371, "uuid": "33067852-5d9b-451f-a3ed-00aeff6ffe36", "value": "460340e2ce791b610d6d419830ceb88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775371, "uuid": "3caa1a6d-04b2-4233-8a49-6f723689208a", "value": "1536:ofKj3h+UwcW1e9OuVt5X788MKgSBA4mZY3tyiJlUygR:NjxMg28MKvBAT+BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638775371, "uuid": "a9ff303e-b6c9-4581-9599-127c416ad091", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638775371, "uuid": "480b8d40-a28e-4db9-b644-09c3207364ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638775371, "uuid": "f3e4be40-7884-433d-92ea-9276dafb4dc9", "value": "Facturas DHL Parcel 48_06122021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f0f11e-56b6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638810379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810379, "uuid": "7e1808e1-26af-4768-80b0-ec06c5353970", "comment": "Malware payload", "value": "dcbf0c964a99d2760d647903d31b8999", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810379, "uuid": "c3008cd5-5b51-4ce8-b3bf-6a5550eb07eb", "comment": "Malware payload", "value": "e642d16f7ba55d2eb23907883edce998da53a7962ff95900615a264756714e19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810379, "uuid": "b8e31250-e4d5-44b6-bdf4-db807011dce7", "comment": "Malware payload", "value": "f9d8a30e104f9d71eada106ffebbf78cac32a699", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810379, "uuid": "b8706ff7-6ad0-4523-bcf0-48a42270468d", "comment": "Malware payload", "value": "873b3b20d1f2909231a646fba1edecfdfd69a991ea23ae0cbc4665f142e8715291a86772ca0a6fefb6b4778be5bb3723", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810379, "uuid": "0ee5be80-44e4-438a-b3a7-c873ed360430", "value": "T1CD253A09BD809F52C5D92B76F64E429833278754D3AAF30759044739BB87AAF4F3A309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810379, "uuid": "9e2f5928-1241-4cbd-b376-f39d640fe664", "value": "12288:2xciL2afi8um66U2A6BKPCLTgOThBxO4pYArZIZG0oD6ctddO9Op1vyK7Ojkuzwo:xohEPCL5LEeYA1acyYwk5/wyWwK3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638810379, "uuid": "5f60510c-bb4d-469f-bac4-036e7dca8977", "value": 1001465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638810379, "uuid": "af3e5ec5-d3c6-4692-9d9f-3ee3033e2d63", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810379, "uuid": "c67e2176-266f-4f23-ba35-df85bc5b7021", "value": "dcbf0c964a99d2760d647903d31b8999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bca5705-5643-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638760838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760838, "uuid": "5d9aa5c9-7eb6-46b4-a1c7-649130f86be2", "comment": "Malware payload (AgentTesla)", "value": "7ea94b3a2e4ce18cf237f09a94647606", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760838, "uuid": "c34882e6-5884-4ea4-a5ba-644feee2bb6b", "comment": "Malware payload (AgentTesla)", "value": "e77447a9ebec55ce1989c4fd34165d628cae27456585d84b3d4f977666152983", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760838, "uuid": "f85fd5a5-6d5d-4d67-bd90-a4c38a40e410", "comment": "Malware payload (AgentTesla)", "value": "af9a4f91d2ed4f097f4144a62e44289c5c565a56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760838, "uuid": "677a05c0-7f41-44cb-89f4-8eb1154e48f7", "comment": "Malware payload (AgentTesla)", "value": "15468b5f79254496fe299ee8dc56efccf2ca1ed37d549f1834584ab369bd263248235832811a9bd55afe73f36d8b423d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760838, "uuid": "6a528e2e-4c9f-4fdb-b7f0-5dec0f219f25", "value": "T1FD55BD2C25750867ED3C1A3505454B3B9EF05C7CA9ABE7CE7B4035AF4AB12C90B262ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760838, "uuid": "8b5b8f53-2a7f-4433-97aa-022f110a5caf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760838, "uuid": "8f75d95b-be50-4ef3-863a-03f07c4235c7", "value": "24576:cN5eB2AexEmMQRL6DMFEAuUDCqZajNKajVQVwc/Vo3rYT9NJTyf9DJ:G5goEmNLpJ9ZajN5jYwEooV49DJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760838, "uuid": "affcfea7-3945-4833-ba95-1eb29d683d59", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760838, "uuid": "59fb444b-f190-4bae-a898-4110a3a90b16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760838, "uuid": "f1f291cc-95ca-4114-af43-902983d98521", "value": "new purchase order PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042b0a98-56dd-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638826779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826779, "uuid": "44c605f0-213e-4db3-8819-984decbdeeb6", "comment": "Malware payload", "value": "556fbe2a46472f9634523110b98f18ff", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826779, "uuid": "d1cf2d59-a377-4d8b-8446-54324ae15593", "comment": "Malware payload", "value": "e7bf9d98a194ec7067365153b6ce9129746c42b9472d676e8ff142a36dee7f6e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826779, "uuid": "cf6efb85-01d9-442f-af4e-2cc1a037b8c3", "comment": "Malware payload", "value": "ee4965f1ac7492236ea90bf6d36a3e21d4fbf17e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638826779, "uuid": "c1235d8f-29fe-4866-861f-97a146ee41e8", "comment": "Malware payload", "value": "8e726b11fde4c17382542d8fb2032fafa1b8d82fbe491269c704fbd8935c11a8066c8260650c81b4ba4c1afc82c033d2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826779, "uuid": "47c0fcd8-0f4e-41fb-8bd4-f5f663859540", "value": "T19CE2E014C042EC19DA2A9DBEE69066E1B524C1136048C44E1879FBCF8B7269F137AFDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826779, "uuid": "26ef4bef-6651-4c92-a25c-402267e906b5", "value": "768:WSwkLNQ61vxGMRQ02VWnZdw9822zAutrLfxl1IKS:WSNQgxGmcWwkxNLfx3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638826779, "uuid": "05e924db-8ab0-4f9c-8317-1d7288fe315e", "value": 34093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638826779, "uuid": "41cf61ce-ad38-44c1-9336-c9fef8309c26", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638826779, "uuid": "93d5fa85-4df1-464d-a425-51c602e812cc", "value": "question 12.06.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18017598-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778280, "uuid": "e898bad4-0305-45a2-a832-c335c51ff53e", "comment": "Malware payload (Mirai)", "value": "4e5d720934c79b8419e29ea8d6a03473", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778280, "uuid": "a2c8e21d-328d-4370-8aa6-1326aab3adff", "comment": "Malware payload (Mirai)", "value": "e91327a02fc710f0b81a39b60ed410f207ffa9b1efea9038375a4c2b487dd1e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778280, "uuid": "8075cf49-5506-4948-9756-80103a8292fd", "comment": "Malware payload (Mirai)", "value": "16c1f65d1399da50a377cc91662f4d4ad900858f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778280, "uuid": "1b55d102-3867-4cdf-bb9d-b1f618c19b09", "comment": "Malware payload (Mirai)", "value": "c12b28f91b2ff983a98c113e74fbb3ad3191b6b98e6a1af4b63f65abc52a221b2cd6752d97305c7d3199461258ae5368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778280, "uuid": "40d6631a-51e0-4959-9f93-21e5f6c7e82c", "value": "T1C7B32A93B800DF77F40AE67604D34B24B670BBE20E5316627357796BAE362D42827F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778280, "uuid": "0f29eeae-8ba8-498f-8fa3-1b951323f7c7", "value": "3072:Cqt8uZ0XVMRVMTK/jyH/dyrGu24qmQWVi7rxO4Se:Co8FXVMReTCCyrLFqmQWVi7rxO4Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778280, "uuid": "64c73ea3-21da-4141-8cca-e3539820902d", "value": 107584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778280, "uuid": "90383bb6-8815-49b3-88a4-2f90468064d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778280, "uuid": "18ffa483-4630-48c9-80cb-6ae45d48901e", "value": "4e5d720934c79b8419e29ea8d6a03473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1929dc-56b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638809824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809824, "uuid": "a024b64b-dc70-4559-8f4c-91f149c6f943", "comment": "Malware payload (Vjw0rm)", "value": "46d001587dd33056afb6dd4f8ace0310", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809824, "uuid": "442a1388-b540-4c05-a197-50b81ab8adc9", "comment": "Malware payload (Vjw0rm)", "value": "e913fbfe0af0074695ba3d6d8306f5ab24699df20c0fd2309dc3c3aa80d3271c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809824, "uuid": "fcde3036-868e-4db3-b7b7-d7afe902df65", "comment": "Malware payload (Vjw0rm)", "value": "6f7b364e422b91bfdc5321fcff95438223da153c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809824, "uuid": "6bca1f98-f868-4891-a56e-9c6e1217b138", "comment": "Malware payload (Vjw0rm)", "value": "e55ba88bd11f302baf45b68520fbbc87a3895360770c75d443a7fd4f00e9eff0f5e2273963932aadec62f6be91532964", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809824, "uuid": "10e0578e-1958-4017-8f0a-d4939ff27538", "value": "T19512AE3E42507974674053BA1E5ED259AF2F3E721432DB0CE4F0C3C8BA24BD88BA409D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809824, "uuid": "32d94a90-4110-484c-9b80-efe17eab1611", "value": "192:t3dIqGSwdxe+3o+/y8yr0kpWEk06ClXB1G6gZQseFi1A2IYZ:hKqGSwdR3o+aD4kRf6CdhpW1At2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638809824, "uuid": "294a700d-f6b7-4579-82bb-750e4718c3c9", "value": 9491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638809824, "uuid": "b1582318-5ebe-4166-adc2-027151c008ba", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809824, "uuid": "e74dc55f-b637-4757-bc86-5edda5e6a478", "value": "ZXRTBNUOO1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a022e152-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638812009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812009, "uuid": "4734f4f1-3d88-4fb1-bb96-0d0268881495", "comment": "Malware payload (RedLineStealer)", "value": "3ae5ee52d63356bf83b209c8510dcb48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812009, "uuid": "db1c59d5-d63e-49f7-9afb-c400bc8506cc", "comment": "Malware payload (RedLineStealer)", "value": "e9c41e16794c4977e98bc2fdd4c652f7159e6e809d39d05b348f9f21db7758af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812009, "uuid": "016ae8e4-01d4-41f1-bc7a-2f3754403504", "comment": "Malware payload (RedLineStealer)", "value": "37b19932a3693fa95ddeedf5b2dd292bfd0b93f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638812009, "uuid": "b35fbb0f-0d1f-4507-addd-1a134e48e9ae", "comment": "Malware payload (RedLineStealer)", "value": "11a11754f4b591871142ac834b4420b94e7f70dd892b839c066700fc2f6d5742534dd9ea956a2e5a80732e49d4ec60e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812009, "uuid": "af15052a-857c-48ac-9940-045859118ebc", "value": "T175C4E1D1DD8B91D6E03F867787736C34051EB2A58AEAD66D22906F05336B8C340B7D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812009, "uuid": "a0793f5c-792d-4b97-861d-f0195ab1aac3", "value": "66693689ec962a10fd9baae275d8b303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812009, "uuid": "1d6954ec-f050-40d5-8d42-96ad1397b937", "value": "12288:E5ZZMAaXbI4YBeW4p5YQ/GG8lfzxCv/0dBU7:I7MnXzjo2IlbFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638812009, "uuid": "93430f8f-36d7-4453-9e01-a75322b209bb", "value": 575680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638812009, "uuid": "674e230b-0d14-4de1-875e-240e05f088b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638812009, "uuid": "4aa31ded-0776-40c8-91dd-ceb28e753f92", "value": "3ae5ee52d63356bf83b209c8510dcb48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4bb294-56b7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638810581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810581, "uuid": "c8ef055f-8569-4d30-b9ef-b7b7296b778b", "comment": "Malware payload", "value": "b69d2142800796e7a76c877aca1ee167", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810581, "uuid": "dd928866-44a4-4f68-9304-78017c915edb", "comment": "Malware payload", "value": "eb32b804fabf80f03dc55216fb076cfdae1d091c3864d0193e9009bdfac80124", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810581, "uuid": "8a231f56-b09a-46f6-a253-4079254e8c93", "comment": "Malware payload", "value": "695b6d21f8d8d8da030b4c6ba24aac2be95317fc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638810581, "uuid": "67e5655f-5380-44d4-a795-30d8b1c19d92", "comment": "Malware payload", "value": "29e4c15eb5877427bc0f943c53b9bb3418b2f39c07b8d0162024f9c0b6d355a822d2c0d5a9f9644853785947a6d92412", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810581, "uuid": "4eb7cccb-2c42-4440-928a-c826eaacc6e2", "value": "T1BEF09E1FF417FBD711735663E4D3803C85F040D909A48A2C9066078D8BD48B939610BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810581, "uuid": "be67919f-16e0-424d-8422-fdf30d5893a3", "value": "12:TaVLMUVb9wCPayBmjZ/kkX0DLIFnyR0CdwfTZ22Qp+KH0TC:mV4UvXCKE5X0X+nmdw7tQp+KHcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638810581, "uuid": "4fa56279-ff85-43d8-8161-5e8da2bc091a", "value": 631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638810581, "uuid": "b5cd0f87-67c4-47ca-a862-b02790979704", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638810581, "uuid": "dfb9df30-33c4-4a0f-acda-efe4a2c8bba6", "value": "UHNMA702NQ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc6479e-5656-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638769080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638769080, "uuid": "6cb4c1a6-24eb-4877-8d05-516cf9ac98f8", "comment": "Malware payload (CryptBot)", "value": "3ae650be3b5a5731dedcc9fc7200fa02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638769080, "uuid": "294498d4-8297-4e7d-9cb2-2c41b3f2b266", "comment": "Malware payload (CryptBot)", "value": "ec33c4fdbf30fd5dfe02d8c393410689935d94c57b08bd075b7d836101bfac18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638769080, "uuid": "0ceed5dc-a0ae-470b-8989-f9a5ab920690", "comment": "Malware payload (CryptBot)", "value": "a3f8886de90d85e24213e41ad2ba71630768f31b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638769080, "uuid": "7bc395ce-430a-49f0-b0fb-7d50be8f199a", "comment": "Malware payload (CryptBot)", "value": "c02b322c25cbcde3168a518a55cad5a61e52268d221bff1b9237ab7ccfed2b8418a32aedae685c5632286c836ea86ea9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638769080, "uuid": "3c826766-c711-4b29-9ce7-1001d68420b9", "value": "T15E84CF1176D0C033C08765768E25C7B16E7AB4710A662ACBBFD85FBC5F607D1A63630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638769080, "uuid": "746855a7-e71c-48e7-b741-a4815bd515ab", "value": "3b35b020e2039ef214f663d245b6e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638769080, "uuid": "874fa19e-3301-4f5e-98dc-0e57c4c83565", "value": "6144:X9Pq6mOuVrDfix4GlRVJmo4j/2XrpiDF7vF0gDfpC0dsnPN:X9PZuVfiSGlRVJV4j/Wird5uPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638769080, "uuid": "09cbc212-2167-4f47-bd0c-f4c0caaeb90e", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638769080, "uuid": "faaf8095-7ed7-4674-9ce3-987adb7bdff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638769080, "uuid": "b1d6b42c-7cd1-4933-8715-4073d7b2077e", "value": "3ae650be3b5a5731dedcc9fc7200fa02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597f01ec-563d-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638758203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638758203, "uuid": "68302926-0e7e-4dd3-85d1-a4472f3d1a69", "comment": "Malware payload (CryptBot)", "value": "b827661464b7e8e47315262b04a8a72d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638758203, "uuid": "a704a147-1903-4205-b515-81cf9764168d", "comment": "Malware payload (CryptBot)", "value": "ecb34d9625c29a3ecd268c269bd82c4cb616b1aeb9794599065db4c8cda77dfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638758203, "uuid": "b651b0b4-6aa2-4f1d-a008-135c9cf7e147", "comment": "Malware payload (CryptBot)", "value": "e62a297dd08cffa7b61e58ea983fbd92e1638547", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638758203, "uuid": "3ac76125-08e1-42c4-82c0-d3b60c1b8c31", "comment": "Malware payload (CryptBot)", "value": "a4ba5e85bed081b662ae519e0216904bb64340e56957fd8526fd7c7b47f058cc4b77314021915b92699d0e2b676d2e01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638758203, "uuid": "7d3ce551-a363-4abe-941f-3ef7594c5e8b", "value": "T13E84D01272C0C033C096A4B68925CBB54E7BB4711B666ACBBBD86FBD4F247D2573530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638758203, "uuid": "9a6fca32-70a3-4b0a-aee1-8704d7bea306", "value": "c6dd551f3faaabc1b84b7af1e0dd4536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638758203, "uuid": "12d8ae57-2b7b-4282-a284-a47b6546d932", "value": "6144:HHPJTpdflucCDfsn38QANZGKAamZTr52xe8GqaECNbaq:HHPJpfuDfs38QANZ3ba528dq0Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638758203, "uuid": "ab5be933-5816-4cb6-b48e-a52210e3d2b4", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638758203, "uuid": "e684af72-beef-4207-9b17-84892fa4ba5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638758203, "uuid": "43b893d6-6c09-423b-b9ad-87c5390e030d", "value": "b827661464b7e8e47315262b04a8a72d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfe1fe0-5688-11ec-96a4-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1638790287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790287, "uuid": "1a32a8c5-b310-4388-befa-86ff663820d4", "comment": "Malware payload (DBatLoader)", "value": "35691e5d0b01ae7fd6eac8ec9f99ba7d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790287, "uuid": "3917d9d4-fc75-4e6b-8e8b-5cdd6a2b2a08", "comment": "Malware payload (DBatLoader)", "value": "ed1d279d93f8882f951b4e4a072ca919b5d9b42b8f83da74c8ad2ceb4cf0f634", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790287, "uuid": "9c6f3bff-4d7b-4242-9ebc-48e3f80f0586", "comment": "Malware payload (DBatLoader)", "value": "03d5c24fa436d048b5c951d0f9293cfedaa2dac2", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638790287, "uuid": "7d10d6af-6b20-48a6-8b4c-32f0d3417dee", "comment": "Malware payload (DBatLoader)", "value": "80082addb5ea78249bf33eb73a01c03f66eb39258c435de15e8bf038cedc92f5d868457139257366412a37a9663ca2e7", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790287, "uuid": "3277ebd5-471a-4b2c-bc0e-51bd3c05eeb5", "value": "T199359D3572A0D873C13B06B8CD57E7E41825FF216A54DE8B3AF57C8E1EB5690B816283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790287, "uuid": "50069225-be2a-436e-850a-b18819f651e6", "value": "63129113d28408f1ff3b0b14b238be7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790287, "uuid": "4e290a18-f1e7-4b41-bd2a-6785f1d198af", "value": "12288:IZLuO0wmv2pdKSKVLmbPy7PXjW1ebIrUxhmKQHwy22NwtIKmmTIy7hdFRcqz:4CRv2pvAmbPy7PaYbIryhmNgtIKuW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638790287, "uuid": "97b0a00b-70be-42cf-ba21-66861e41f532", "value": 1062988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638790287, "uuid": "1bee6914-23e0-4254-b787-0c4d50814da1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638790287, "uuid": "e16af658-9e50-4404-9f65-0e57469157e0", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832adffa-5685-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638789197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789197, "uuid": "1c29b58e-45c8-4ad3-90cc-1b9aeb9eac01", "comment": "Malware payload (RedLineStealer)", "value": "c0228fe99f2e4bccffa7f0eaabcfa5c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789197, "uuid": "bb831b8a-b58c-475f-83c6-81cb23481d9a", "comment": "Malware payload (RedLineStealer)", "value": "ed306118f93c0f8925d5840ab3d40ac4b5e2e2b918675fd5fb2e6097b68b3b32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789197, "uuid": "d51f86a1-2274-4595-a421-b80af994e676", "comment": "Malware payload (RedLineStealer)", "value": "c2986a669a56b790fa05afd73b9d67fc11cc52be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638789197, "uuid": "03457518-6c3a-442c-930a-21086eae1cc6", "comment": "Malware payload (RedLineStealer)", "value": "c6f83138e63586e9af4a239ee396ed51705c17e7700a09758ff419b906266666e9184fe64ac689fa0ce2054effbc6d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789197, "uuid": "3160e8e2-fe6f-4338-8b9a-8ed346052c7d", "value": "T1E294DF1276D1C033C0A624754D24DBB4AEBAB87107666ACBBBD81FBD1F647C2973530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789197, "uuid": "ac6ca317-0bb3-4c0e-9d8a-7c5e12c9443f", "value": "4325f80604025ebf735afbb33e633196", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789197, "uuid": "2ba0724c-2e94-4ba6-8f99-5e1b9ed6d4b9", "value": "6144:zemYAbmVXPDGD/xRB3/R/AOjNR10PY4Qz3ryj3L40RDRqQqGMi:zemvbsPQ/xjZ/AOj9L3rG3L40n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638789197, "uuid": "b9f2495d-ee0a-4a18-b84b-167d06547d57", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638789197, "uuid": "3dd9d80a-be11-475e-acba-f16723127dd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638789197, "uuid": "ed1334e4-8410-4ba6-8038-c6674abe4e51", "value": "c0228fe99f2e4bccffa7f0eaabcfa5c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55dfb602-564d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638765069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765069, "uuid": "0958df89-cc49-4d61-b84e-4ad73a9a6d82", "comment": "Malware payload (RedLineStealer)", "value": "64bdd484cb0664c589aff376fe96a96c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765069, "uuid": "0600ffa2-2cd7-45fb-bf6c-b63f25f78afd", "comment": "Malware payload (RedLineStealer)", "value": "ee005636f3291041df71741e48b453da3141fbfb42acb52bc568a4d327c8eca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765069, "uuid": "5178041b-262c-4e9a-8ad1-38fc3cda0ef3", "comment": "Malware payload (RedLineStealer)", "value": "2ab2e486fb6b23526e2c108fa3b9bc7be058c477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638765069, "uuid": "8c3e0d98-0c66-4589-8ff8-606fa1dbd62d", "comment": "Malware payload (RedLineStealer)", "value": "37cf8a05e93b1fba85441aac640cc22faaf7f96bea1b9e781f3cfaa546c51537c28ece5c8596bd82f634676818faebde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765069, "uuid": "f35f09e9-c094-4579-8139-690e591e4376", "value": "T105B4F05AB067CA76E02B0BF50D12A4B40F7A2CECFE01C565AEC935EFD2357848CA6553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765069, "uuid": "c8feaa17-15e3-4f13-8c4d-7591a747c302", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765069, "uuid": "112de5c8-0343-4f24-8756-e7388178db65", "value": "12288:6LLYmcphdsfl2WmPYOqthgLs/SGmqI5gS:6iiNJxPgLkSZq/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638765069, "uuid": "bf079b42-a015-4c83-964c-338aa08e2f7c", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638765069, "uuid": "8108785c-2933-492d-9b23-e21c72f00b71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638765069, "uuid": "d6afae52-b1e6-4e9a-ac41-6911f3d86367", "value": "SecuriteInfo.com.Trojan.Siggen15.58239.16303.8602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1a2399-5648-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638762960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762960, "uuid": "cbdb05ff-e115-4265-863f-1b13b12cc72b", "comment": "Malware payload (RaccoonStealer)", "value": "20ae37b4698990c699a5f3cd54ada1eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762960, "uuid": "59810914-545a-4b73-acef-6afcb3923c3c", "comment": "Malware payload (RaccoonStealer)", "value": "ee3e7d2742d255dff6fd48dad7a579290559f3c014ddc0bed1781a4a89c6d5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762960, "uuid": "cb4f2dd0-5963-46c8-b1d8-83e6d481ade4", "comment": "Malware payload (RaccoonStealer)", "value": "3ad78f0ac5c3e1e392f781c09d5c88d3718fcbe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638762960, "uuid": "ebc38dfa-a36c-4694-9ddb-a09cfdd033cf", "comment": "Malware payload (RaccoonStealer)", "value": "83642430a3bc28d844545e807966e917d478cf7a661693c0be296f90fdedbc64ff23af0071e83c39d2ee959af4abb1ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762960, "uuid": "3c531ce2-66e1-4cd5-a32c-d9df270cc527", "value": "T17854AD2133D0C032D59329768925CBB58E7AB4715A666ACBFBC41FBC9F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762960, "uuid": "1bc3206a-dcf2-4ca7-a29e-ed6ff783a76a", "value": "6c355763d97257cce28120024c0d5f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762960, "uuid": "01f1b37b-bf92-4cee-9cf6-72cad5c6b2ce", "value": "3072:0j9LAasjGN1yIyKZgui9ZFoJiz+iKghFOhrDVQu27rB37tGBC4wuKqsQHIj5fe0t:wlADGTPdmZZ/hFADVrgByClx6HQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638762960, "uuid": "d73772f7-7936-401e-9ceb-aeb2aafb1d7a", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638762960, "uuid": "8b516766-335f-45cc-9098-e56b121373ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638762960, "uuid": "9b117ec5-05ac-43c4-aff8-8fcd94217d6c", "value": "20ae37b4698990c699a5f3cd54ada1eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db58291-56a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638800730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800730, "uuid": "d80cfba1-53bb-47b4-a7e6-218c75e853e0", "comment": "Malware payload (CryptBot)", "value": "cab436d07eb1ff3826a830ed4b477da9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800730, "uuid": "f1020c1e-226a-4ab0-8361-4d83a4d86e55", "comment": "Malware payload (CryptBot)", "value": "ee53cf56f393658949e4756c48e63e0c02542c1403c87e72d926bfb6b0306809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800730, "uuid": "973fddd5-534f-47f9-9153-37e986bde497", "comment": "Malware payload (CryptBot)", "value": "efa4b5ae9c6806766baf75b0fe3802d1f6954124", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638800730, "uuid": "21f60573-ec3d-4757-88f2-4460b577a486", "comment": "Malware payload (CryptBot)", "value": "ef547498e0b9d307f4927804f277707955df469591900add3df8c12900a66fa2e92a74563221d8a2e401b84748ed83c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800730, "uuid": "38a14c03-97f6-4e2b-8aff-edec743c194f", "value": "T16B84D01136C0C032D09265758D11CBB59EBAB8B50B6669CBBBC85FBE0F646D2D73630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800730, "uuid": "fbe1f67e-fbd5-4db4-8873-7ce9168d59b5", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800730, "uuid": "5dc4e7d5-b503-4047-ae58-1a7bade157c9", "value": "6144:GDZYpC85so+F5+BtPLLDtvPDevxt1xVM5hfkvHSxnn2RBSJvUAtIvdqPS:GDmf5s5afLJPDevxt1UFEyxnn3UA2gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638800730, "uuid": "d1140402-cdd4-41a7-b103-c193111b9676", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638800730, "uuid": "63087fb1-1163-49d1-adf3-6bc347e8e585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638800730, "uuid": "d4b7c688-2d27-48b6-8f3d-78d444bef8f1", "value": "cab436d07eb1ff3826a830ed4b477da9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded639e-5675-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638782504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782504, "uuid": "938115c3-f3c9-4cf6-b79d-95cc6955fc83", "comment": "Malware payload (Loki)", "value": "5cc6fc2f78336352bac6975edafa2c1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782504, "uuid": "39c261d6-ef66-4147-af3c-317d1d73fbd1", "comment": "Malware payload (Loki)", "value": "eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782504, "uuid": "dc3d03c9-007d-4a4c-ba1e-2fb584098938", "comment": "Malware payload (Loki)", "value": "ccb86ddabe85e1ef348ff3dc5f24577040da5f28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638782504, "uuid": "138e6f48-dffb-4d32-baae-5a37c299638a", "comment": "Malware payload (Loki)", "value": "5ee0a46503c679c3d2b9f28bb3860bea68920860453d486cd3a5a914d2a04c180732ed381c1673cfdabe091952bd1e77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782504, "uuid": "16790e63-ce4e-460b-bda8-7d8dae6fbca7", "value": "T121C4F1247BF8AF65D4B88BFC516A26148BF4752BF002D78A0EC631CB2AB1F535A50D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782504, "uuid": "050b73b9-90ed-4f69-a411-4b358c66de2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782504, "uuid": "d25c2095-f19d-46ed-9ccb-acbf6e7b5ebd", "value": "6144:5fUCanzbv0tIO2Q4wB45KYm1WkqbMB50Q7FbjDtnFxCW9+Z4+IBkFqQ4MB45KYmN:9OjwBJ1WHwqQ7v54HIBkGMBJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638782504, "uuid": "1b644c57-fe0b-446e-b82b-1747e8166079", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638782504, "uuid": "1587de18-5390-4c38-b122-3900e6b0febe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638782504, "uuid": "61427357-4773-4b3f-bc86-302d0bfe23dd", "value": "5cc6fc2f78336352bac6975edafa2c1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d654398b-567f-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638786759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638786759, "uuid": "37d22e03-4f85-4fbf-be69-4ea336dbc3c6", "comment": "Malware payload (RedLineStealer)", "value": "33713f764123409cd5e7066f23843fea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638786759, "uuid": "e557d141-2d25-48a2-95b2-88a16e0d4e4e", "comment": "Malware payload (RedLineStealer)", "value": "eecfc59a88b626a75d2c4f2a578b4d3017c511a70950b82cfe5b59b90d6ba65b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638786759, "uuid": "b8f8db98-1059-4459-9522-ee7f0d5081b3", "comment": "Malware payload (RedLineStealer)", "value": "19896ac2b531bda842562bdcba41312a28184ef8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638786759, "uuid": "3c287c38-95bf-4306-ab4e-1be10e53f0d7", "comment": "Malware payload (RedLineStealer)", "value": "3617ccae236897226f2a604879ecbf2ef1e3b6e69feb587103d7804594ec61ff1cba5b1391d047b45f5d7a5c4c33f40f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638786759, "uuid": "522865b9-852c-492f-9ac4-ff6483c38db7", "value": "T12854AE2133D0C432D59725764524C7B98EBAB4702A666ACFFBC42EBD9F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638786759, "uuid": "82eac339-f104-4aa4-b7e4-5bb7d0a59df6", "value": "4325f80604025ebf735afbb33e633196", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638786759, "uuid": "ab6720d6-1042-474b-b11a-190ac649f8be", "value": "3072:12ZU20FrKLEFWi30gC1x9VGKJiaaKm7g/FeZVDVLhlnEhhM/vXEu1TTBDNj5f:10pEeOWfNVRX/FeDVMHisuZTBDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638786759, "uuid": "4d88c4aa-58e0-4a90-9342-d4014d2a0429", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638786759, "uuid": "c305fe49-21a5-4a47-8951-c2281b5b27d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638786759, "uuid": "393dd17f-8418-4498-9b1c-cd41825409f2", "value": "33713f764123409cd5e7066f23843fea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2554e8ac-56b5-11ec-96a4-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1638809655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809655, "uuid": "e5cb53d5-7af0-4126-934d-6fdc35c8021d", "comment": "Malware payload (NetWire)", "value": "731897f9c1288f50a2c3684869b56dba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809655, "uuid": "a5c752e8-bb94-4379-a98e-e9e6a320a1bd", "comment": "Malware payload (NetWire)", "value": "eeec2f71b05b8a71de011e002adf1c9c3b6da84c12517184bfe0b3ccf04d1a56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809655, "uuid": "37ff43b8-36a3-43ec-8948-bbc0df5099eb", "comment": "Malware payload (NetWire)", "value": "a9f3a6f93e04365d300eb7c88b7e06000d91b66b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809655, "uuid": "d05f1631-16a4-49ed-9297-9f12fa64c4a9", "comment": "Malware payload (NetWire)", "value": "d3d37ed44ea8b8e2493cbcbff9d605cdd25969cf719726252d677e8d7e3c33d7b101b2c2c9189957443e43945c3f08a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809655, "uuid": "ea553557-a1ff-4d90-b30e-b9017128ce48", "value": "T15B556A5C317025AFE83A853145541F3B9EF12C3E866B63CE7317349B8ABD9428F252E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809655, "uuid": "ce9563ab-7a9c-4449-9eae-b12c85b31f80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809655, "uuid": "67af47ef-f887-424b-ac25-379b23df83ed", "value": "24576:32vAFLUyoctCm+e6M8xWCoB1k+uE2VJTlMOXnCXZhdsP4yxw/:aMLPQm2fxMB67EwxuJXZhKP4d/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638809655, "uuid": "254d7fa1-1d28-4fcc-b351-9b63b38a7aa1", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638809655, "uuid": "5e046979-ba82-4b83-bee9-d9a525992bdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809655, "uuid": "73bc5a7a-f610-4cb2-a2e9-1e13295499cf", "value": "731897f9c1288f50a2c3684869b56dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7799df-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638773215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773215, "uuid": "e1b39bea-d861-41da-8e7f-29ea630042e8", "comment": "Malware payload", "value": "221676797eaf440411e20ea7e22669fe", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773215, "uuid": "9728bbae-5994-4690-aa98-a319e265d4a2", "comment": "Malware payload", "value": "eff2feb50bebb797db7d881a44c549234315a84c861d2bb675899f7165db3ce7", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773215, "uuid": "d421a862-bf11-4052-af97-b913373bb31a", "comment": "Malware payload", "value": "547ac1614bfa17673d135ef6eaa31947c5e05273", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773215, "uuid": "0338e657-235c-4dd4-ba34-9c9635b8a7b5", "comment": "Malware payload", "value": "12fa120262c18c2421491dbe0bceb8dd55b1ce89ce1369fc12eebc43bb85a5090346302e95a76b2429c64a7998e1fd3d", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773215, "uuid": "0c0aba72-df87-45ca-ae0d-e9685e4efb3e", "value": "T1D672C1574DC926A9DEB3C2BC9F6F022B2954DE1875AEA1C57C03391C4A533231C15BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773215, "uuid": "aec4270f-b446-481c-9084-d624e7db68e8", "value": "384:KSPXpUTlOfqVIPgzWu9ha8cZSETAHPawOimv+8Gi7AY4WgbX:nPXpUsiVIPK/TxEEHPag8Gi7qWcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773215, "uuid": "eee724c9-aba4-421c-a2c3-5bdc829bf22d", "value": 16433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773215, "uuid": "2c6c5205-0533-403a-9c02-593da4b8d6c5", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773215, "uuid": "be4a7329-64f4-4366-aca4-dacc94a5eec7", "value": "Order List - PT Natash.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ebaf32-56ba-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638811805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811805, "uuid": "76eaf070-fd97-49d6-832b-fa78a597dc09", "comment": "Malware payload (AsyncRAT)", "value": "783c44c79e68cfc24fc9aa6215268af5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811805, "uuid": "982cfb93-82e3-4a9b-a80b-8c50aa662494", "comment": "Malware payload (AsyncRAT)", "value": "f05cde9f4e88822acaeda030013c839ba2b46ee74dda0849ad83fb455552e446", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811805, "uuid": "07c38883-7534-47af-bd54-2ec4e303d8db", "comment": "Malware payload (AsyncRAT)", "value": "ebf4f2bf54851fbf9fafb25b026e29f4ff2da97d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638811805, "uuid": "745759c7-401f-453a-ac11-ab99af3df162", "comment": "Malware payload (AsyncRAT)", "value": "0ea0c9369dba81ca7bbada73b0b47181bcdb0b2d11d1ccec4b0e0638e1d7d72380e7916e4d98f7383ec34a97d6ceec53", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811805, "uuid": "443faa1e-16fe-4865-850c-4c3ae35e0c71", "value": "T14474CF462AC5D6E8F83FEBF50CB475C503B8F1D0EA40F2EEED84255AA862B954F10572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811805, "uuid": "4d929097-ae89-4059-9395-9beaa09632df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811805, "uuid": "d15a40ec-609a-411f-b144-5d0d8fcdd006", "value": "6144:ONNYqNSmWFRSJa2GhNbgacnHwPB5rmjqT1sSrD/hYs3gkLhLHvNZ:Of7a2iNsacQ5BbD/yswgjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638811805, "uuid": "6e68ec0f-64ba-4286-9f56-f15fc927953a", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638811805, "uuid": "af03f6db-5a41-4365-86e3-a711b4560475", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638811805, "uuid": "6cc5bcb8-9ee7-4c5d-b381-2df77664def8", "value": "783c44c79e68cfc24fc9aa6215268af5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5e91c1-568d-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638792626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792626, "uuid": "601a75b7-3ee2-4b20-9ab0-74c30d834f1b", "comment": "Malware payload (IcedID)", "value": "09f6293c7dc735b4bcda63ca6e3b4ea1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792626, "uuid": "9629ce7f-8769-41c4-afa0-c8517ffe29d8", "comment": "Malware payload (IcedID)", "value": "f05e9edc503214f7826d228b888ddcfd5d78e922d540968eaf20c5cc03b8f2f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792626, "uuid": "fc07493d-2b10-4424-975f-16d906f3de0d", "comment": "Malware payload (IcedID)", "value": "a77282826dcf172da5706fbc57312ac37992ace7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792626, "uuid": "dc068d27-0a88-48ae-935e-43af3d11962a", "comment": "Malware payload (IcedID)", "value": "8f5279e385c4cf9ac9249ac6ba9e6769cec575cebb992bbe47b3e3d3d509b428daea4294a4bc1879c304fb986dd38439", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792626, "uuid": "1e94c73f-1def-4efa-bf18-f139fd9b4d7d", "value": "T1821538AE44CBC59FFEA18838DDA46AE3C293976ECD6AC9F34D8594302C114D9487B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792626, "uuid": "132e6203-47e1-4e6f-a140-e797ff8b4bd7", "value": "f6bdd1c75556d961afd6fb8104c342ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792626, "uuid": "6dd31eac-612f-4e6f-9a4f-5de4be98bfc6", "value": "12288:HfdCRsouYgpzEvqM8dxJ6IO7ByLErvB67s/:HYRx8V6IONyLErvB6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638792626, "uuid": "fc07f2c5-fbd5-49e3-8641-f1c23ebd2ee3", "value": 889473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638792626, "uuid": "dd8b2490-2f58-4a36-9191-d48914540ce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792626, "uuid": "7dff9370-9dab-41da-ba45-9405601610b3", "value": "girlNextDoor.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2b9fd3-566e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779204, "uuid": "3ff35458-4860-4e4b-b55f-a2dbda528ef1", "comment": "Malware payload (Mirai)", "value": "5c6b7db989486f7b6783f68ef6b70125", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779204, "uuid": "4ee78519-1522-45ba-b5f0-e1933969714d", "comment": "Malware payload (Mirai)", "value": "f1d55153398ae097f5eb70bc274c9f2a775563edab1e8dca142192bf81ade159", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779204, "uuid": "3072a9ea-9d63-462c-a7ef-665d2d5b0667", "comment": "Malware payload (Mirai)", "value": "422caca2d8ad009fab4ea52f2041587072002ef5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779204, "uuid": "89a028c9-f0f0-4e97-b5c1-26e1f3ab2f06", "comment": "Malware payload (Mirai)", "value": "adbb28fe290da6527613f08bda383067baf37e65e8540c926df1e5ce861515648d443941ac0aac7d47b16bfd8275c541", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779204, "uuid": "6c151867-f443-42d8-bb88-5ff03f55a8ba", "value": "T1FD33F141F61CA95980A8DA7B2CA1D36253480BB6F25E7113ACFC570E37F49BB5BC24E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779204, "uuid": "d0123fdc-b144-4c0b-a86d-ab61564641ee", "value": "1536:vfW0a1Yr7v4xYaev/OxFayGfMpiX5+lstJ5gCw/CtALY:m/1YQAEFa/EMJFgCP+LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779204, "uuid": "32871d62-6fa5-4cf8-a0c6-82b34157c8e2", "value": 54884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779204, "uuid": "731d98b4-4aa9-4944-bfcc-22c31848b79c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779204, "uuid": "a33975bb-46e1-4139-b6ec-903fbc00a3d2", "value": "5c6b7db989486f7b6783f68ef6b70125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544a5db8-5677-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638783105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783105, "uuid": "ee00ac43-7931-4a03-a489-a1dfc6512e3d", "comment": "Malware payload (Heodo)", "value": "c1ef2d60e09896cf71d3fc0106620ade", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783105, "uuid": "6ddabb77-705e-4ef5-a792-f15c879dd816", "comment": "Malware payload (Heodo)", "value": "f3b25754c16475d0565c49234285b64d85acd3bee99091d2089f6a671829bf91", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783105, "uuid": "cdce38f8-9a74-40ad-9537-815038602e46", "comment": "Malware payload (Heodo)", "value": "ed2af760cd410c552271140dac6f9338019eae8c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638783105, "uuid": "3eb2afe2-4de0-463a-9a2f-155a59fcbb0a", "comment": "Malware payload (Heodo)", "value": "a4be1143acc8f86120db229dcfa69487c7ec8e52c05ba67e26a8c43b31c0f8e85cf3b596994e939c56d6a131cac334b5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783105, "uuid": "79988dca-33dd-4808-af5e-a09bef11e92e", "value": "T12703CF2DC2526858C736A83EC10884DEA55C2C576041FD1F1594B38D2B7A5FB2B9F2FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783105, "uuid": "cc2566d9-7d85-49f7-9001-d3c48ebdb6cf", "value": "768:U/Mvd5dhTkYME7l0VGpevZCw4ZmUxjfC30+kS4Qyot0VIyBgr:Umd5cnE7WyXYk4pmVIyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638783105, "uuid": "3994d54b-9c89-41ff-94ca-1d55978d5e57", "value": 39100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638783105, "uuid": "ef77602f-2fa4-4d75-8d02-a515519a7977", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638783105, "uuid": "dbdf4410-05ae-4dd2-a439-56b4f73b2044", "value": "ugt-88.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1df8031-56e2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638829272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829272, "uuid": "08761c34-8752-467e-a8de-12108933ac05", "comment": "Malware payload", "value": "e7d538a5b589f6c9bd32f46254ca6ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829272, "uuid": "0b0c8a1d-286c-4715-bb69-f3041f176cef", "comment": "Malware payload", "value": "f45e5f160a6de454d1db21b599843637103506545183a30053d03b609f92bbdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829272, "uuid": "31933495-0b70-4119-a149-ed388f1e6243", "comment": "Malware payload", "value": "22a4ff201f2f43be05fe9daf47494b4d212f8570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638829272, "uuid": "76aece7e-7fa2-4d7e-93c8-65a1fd36eb08", "comment": "Malware payload", "value": "1f7d686e3eb74a063a49461639e5005bc2c23d55b10cfb280eb6ce8e584ecc16da4ce446a58663b4e781de1fb887dc53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829272, "uuid": "8e23a549-8abc-4618-a30a-3093af686af5", "value": "T18D056B40EFC24DE7DDB1053555EB9676AA32A60A3B12C7C3E3883531B9117D22AB71EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829272, "uuid": "40e7def8-1318-49d8-9695-eff5f059cbec", "value": "b7a56b6a18e2e0885452c3bbddd2255a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829272, "uuid": "721f09dc-04d1-47ec-85e0-98c566026c7c", "value": "24576:yKPvBE85/2yEoLnnhbk9iL7UIGCiGlIzF3DfTPz:yerxG9iL7gzF3DfTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638829272, "uuid": "682bd135-b8f1-4ac0-8d41-ae9ac8fdc593", "value": 867248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638829272, "uuid": "3dc2200f-06c4-4805-b4fa-3f497184b1b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638829272, "uuid": "588f7e1e-5f34-4d00-9b14-b51071ee4fd0", "value": "f45e5f160a6de454d1db21b599843637103506545183a30053d03b609f92bbdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53443d9c-56c0-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638814457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814457, "uuid": "d4ed939d-9dc9-4337-bc31-0b6fc88ec4ac", "comment": "Malware payload (RedLineStealer)", "value": "a13441d8630703457975588df3de6027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814457, "uuid": "4c0afa1d-4068-4b85-b6d0-ba57afd8522b", "comment": "Malware payload (RedLineStealer)", "value": "f4e8aa60b0e6f9398ee26c776333034961d60fc45fd00f3eaeb50fba428c8d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814457, "uuid": "008ba8b2-efd5-4705-828e-d7c3a53f88b1", "comment": "Malware payload (RedLineStealer)", "value": "fbf92f3c32994308b05fd86afee7deb32017a60d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638814457, "uuid": "521a2ef1-35eb-46bc-828e-fb4ce688a537", "comment": "Malware payload (RedLineStealer)", "value": "0d664962666043f236bcd15bd591935df74931e554de79a68f9a53eed73b0d8965fb49dfecb8b7b93e079821fd21da95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814457, "uuid": "5dfc84f9-de0f-4997-9508-9898d1239d36", "value": "T1C06533ADD4CC176CC05A60FFD528A1FE4B1889791BDCA36B0EB8DE4395D0C84B8E4DA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814457, "uuid": "582a2905-c876-427b-9561-9b7c440e5d88", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814457, "uuid": "f928761b-4d26-448b-9026-833944ddbe2f", "value": "24576:biFP7B6P6HihpzQDHpVooYYb4pfzzYLgQwefMGSJqMcm5pTP8MV+WokEaHNYK3PS:2Pq6H/voofkBzutdK9pHP8MV+rNaFW3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638814457, "uuid": "27001bb4-7b42-4207-acde-866a2be37965", "value": 1543168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638814457, "uuid": "2c48d659-ecec-40a2-b91c-474f1ce43194", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638814457, "uuid": "22cfbbc7-9976-47bd-8399-4a87b18f9a8d", "value": "Skinchang v 2.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14192cd7-566d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638778703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778703, "uuid": "119daedd-e8bd-40b6-8444-0ea1ba5fbaf0", "comment": "Malware payload (Formbook)", "value": "dbe390ebb5e1ca215de123ba1363de6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778703, "uuid": "c12babee-f9d4-4e3d-be54-201c72e7d58e", "comment": "Malware payload (Formbook)", "value": "f57a283465e1965bd586936e894031d903ce7f721f8b02069e83cd8f19734a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778703, "uuid": "ff022911-be7c-4c52-8895-2304a9f0f892", "comment": "Malware payload (Formbook)", "value": "d6529a20eb619978215ccd93dd4f992341f880a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778703, "uuid": "3c49eaf0-a638-4e70-9445-ba62d10c76e1", "comment": "Malware payload (Formbook)", "value": "a945f43b11c81f86d983120b58949c2bc015edb30189dd9290166f4d20f2bcf5af436f1b6ad3232215f22f58b2b06e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778703, "uuid": "168e4e06-6a49-4188-9ff9-99c7a88acb3a", "value": "T134556A5C317025AFE83A853145541F379EF12C7D866B93CE7317306B8ABE5868F242EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778703, "uuid": "bc5f729b-0f03-423a-a51b-6e8e106a3dba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778703, "uuid": "999ae7f0-642f-447a-b61d-00433c09e070", "value": "24576:OFGfIzLN2+QtiC8OfcOD38scSt3foRDfOxedkSe5sPwo2w/y:OqIzLNT45/D3vfMX4oFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778703, "uuid": "42fbed7f-121a-4f84-87c4-4e422dee35af", "value": 1313792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778703, "uuid": "e2e5c4fe-e423-48a3-9d34-74089198246e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778703, "uuid": "5432a392-8458-42f4-a5a4-62e469a16330", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef04824b-5666-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638776063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776063, "uuid": "10b87c17-393f-4549-96de-232b7d4cb4ff", "comment": "Malware payload", "value": "c5f93450e5021bc0da2fe2022256f111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776063, "uuid": "5bb91372-e030-4af1-9e56-382d933212ed", "comment": "Malware payload", "value": "f718e9d196a4a8da1231158a961a38b33101022a9415bea4a802c6888087b3bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776063, "uuid": "b0953ddc-de10-4aa9-8afc-d9988d116122", "comment": "Malware payload", "value": "7411de3ab1af1b0aeaf8b3232fd3563a4dc99b58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638776063, "uuid": "124dc24c-0b12-44e9-8bdc-724202b0f5f8", "comment": "Malware payload", "value": "4ef257b5f81a9c7d0332fd1b5f12acfd0a256c169e6b6cd17018da3d29675029fff807e7a3bc60237f2f06c652086671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776063, "uuid": "16f58bd3-4167-43d8-91bb-0182d2d9c48d", "value": "T195F40201FAD188B2D4331933563DA715697DBD202F249B6FA3E47D6EDB31181A224BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776063, "uuid": "55ec4216-6a1f-4cd9-8ec5-81d713745d2b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776063, "uuid": "633c0a0a-7e65-4592-a365-c63eaaa1cbef", "value": "12288:0Qnk3GDYKGcblwtX+t4Y8Dud2gZNFrpu0J3o1OC90rC9C2+oVVHI:IAOcZwXYy22sFWOTazVVHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638776063, "uuid": "ad39847f-2519-4f6b-878f-f1d0079584e9", "value": 788515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638776063, "uuid": "4e17e39f-3da7-4168-ad9f-fd09580aa841", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638776063, "uuid": "1aecf315-216b-4606-868c-7e21182e7cf0", "value": "c5f93450e5021bc0da2fe2022256f111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a9a61f-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760421, "uuid": "6bfaaa0f-7536-41b8-abbe-dbba713003aa", "comment": "Malware payload (CoinMiner)", "value": "015aae43b84cef99e63a6a518ce5ac14", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760421, "uuid": "03a5c3ce-472d-4583-85c4-97fe83fa2a01", "comment": "Malware payload (CoinMiner)", "value": "f7ac9f1d654571249f850f8b7cf437d4f5e339350bb56ef4808dc0ca13b78ea4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760421, "uuid": "b52d0c3d-2732-4b1a-a79f-67fab078ca42", "comment": "Malware payload (CoinMiner)", "value": "64500abb668d2844d2ca239ab80f6a98478af60d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760421, "uuid": "17d3acbc-db3b-4c34-87f4-8494fe18055f", "comment": "Malware payload (CoinMiner)", "value": "537f9351d2dedd6b802462ac926ecf28289e59d168ecd4aae0ef77fa344941ed5e4f3dfd6ad86cc811d15c5711534efe", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760421, "uuid": "43e4a664-6328-49ae-b470-112c5aaf9d0a", "value": "T1BEC312B743E51ECBE52E38F840464AC45D9DD52162EE16A0FA51B38EAF393378B1C14E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760421, "uuid": "666cf67e-b121-4511-8f66-c32987d5772e", "value": "f6e3350cc15a31d2ff22558cd804de68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760421, "uuid": "e1a031f5-792f-4e6c-8ce1-6a27fb718ec8", "value": "3072:PmwL7HO08Kz/1qrFPvELNd76WHkRGRDvsktX4VQjYv:PbO08Kz/1GkLNd76yLR4ktIyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760421, "uuid": "871a430d-e2c7-44e3-9a9e-e11a1c664700", "value": 121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760421, "uuid": "e12904b5-609e-4819-b486-942cd062ce37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760421, "uuid": "8ab3d356-0de7-4e4f-a42c-54c4aa68b898", "value": "SecuriteInfo.com.Trojan.GenericKD.38157423.13774.29832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2701af84-5691-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638794196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794196, "uuid": "38ea73af-3519-4726-bf72-9fdc887de3e8", "comment": "Malware payload (RedLineStealer)", "value": "b492fdb1c1258eac115b6d2a0aecc45a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794196, "uuid": "c4cd6487-dce5-4bdf-ae2d-ed8ac4816b95", "comment": "Malware payload (RedLineStealer)", "value": "f87a4cf2e9421a0a5d80a687505116cac7ebe9f6864848798fd8e401142e3e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794196, "uuid": "c6dab3ab-0031-4ec0-875d-411e405f6d9e", "comment": "Malware payload (RedLineStealer)", "value": "e8f159d8f776ce2c93faa1d347fc51aa020144f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638794196, "uuid": "cee6a219-5916-4767-817b-157d7395c02f", "comment": "Malware payload (RedLineStealer)", "value": "a3f8930203c5c2126bb685754dbda78474cddfe887a62cbdcbc075ddccf18522abf92a13677687ed77a88339afdcc0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794196, "uuid": "7f923412-febf-49a1-9b97-9220df9eb723", "value": "T1FC549D1133D0C432D48729768525CBB58E7AB4706A666ACFFBC42EBD9F247C1973530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794196, "uuid": "bf9e5200-a316-434b-afde-8fe0643ac28a", "value": "5e0a2673583e2509366fb3f750a3f731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794196, "uuid": "f425d819-511c-48dc-ad9f-36971696d239", "value": "3072:FFjNOrKaRXhvZMBmg4dNp2q3HJivNgTgpT6ulvt4nItUcmTCw/YETTBocX5PAP9:PUr1RXjM6p/3wppTtvtYImcmpdTBlAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638794196, "uuid": "351a42e0-a6ec-418d-a20f-10413af5d5e3", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638794196, "uuid": "d9e59695-61f4-480a-a085-3cc1acffac57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638794196, "uuid": "68fde16c-0ebd-496e-af1b-c080a82442bf", "value": "b492fdb1c1258eac115b6d2a0aecc45a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636360ac-56cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638820926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820926, "uuid": "ebd1c805-1f7d-4712-ac61-18904a19a5db", "comment": "Malware payload (RedLineStealer)", "value": "4462aa76fceee833eb523ef1c27c655e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820926, "uuid": "245bebb1-522c-4763-bc89-eb1fef5a5dad", "comment": "Malware payload (RedLineStealer)", "value": "f8a316e69ebd468c813958bd54f1830fb2ecbbeba9796cca4c9610f8f62c0455", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820926, "uuid": "97835bbf-86cb-4123-b513-7f41eabd7560", "comment": "Malware payload (RedLineStealer)", "value": "74b3794599ac97d94f74f5a109b468227e117002", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638820926, "uuid": "f5d3b67d-9014-4b88-8b4a-ea6348b48d69", "comment": "Malware payload (RedLineStealer)", "value": "e02d1d4870fa086724723a50b4e4454ec1eee998cf218d637c521716cbf613327dc703977b6d6cdb62c66bb61dfe02ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820926, "uuid": "96e4222d-a115-42ab-8f68-efa1b9fc65aa", "value": "T13065337D63806CECF24C1BF0284DBC457CA92D9AF5A4A1F610EB13572789666DEB43C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820926, "uuid": "8d692ab5-ba20-4182-828a-84a025bc66db", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820926, "uuid": "87221c72-2795-4c22-a9c4-2dbd6e2e8f54", "value": "24576:0uaWA6vyA7iTFtxr786RzdrGwcNJfq36QMbjurj0ReMs0w3h1bR1RCtNYQkEaHNF:0NYWxHTJ6wcNxa6vjwgaxZRWNYQNaeZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638820926, "uuid": "28a26f88-7f68-4363-81b8-9796fd2013db", "value": 1523944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638820926, "uuid": "3a704f07-9eb1-49dd-9101-23495a777b55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638820926, "uuid": "0c8fa729-14f9-41d5-85e4-e3e17ceac54f", "value": "4462aa76fceee833eb523ef1c27c655e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73beb860-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638760395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760395, "uuid": "89dd23c2-1318-41fa-a312-7b832645058d", "comment": "Malware payload (CoinMiner)", "value": "5895e63a7bca8cc08b3a0b624342678d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760395, "uuid": "61cc2893-a3b0-4ca8-a134-ac0012aa388e", "comment": "Malware payload (CoinMiner)", "value": "f8e512cd8999ab9a3b83ca080647262389cdd72ee22b4afcecf5100fc3abded5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760395, "uuid": "2757fd57-d866-462f-a516-bc3eb751daa3", "comment": "Malware payload (CoinMiner)", "value": "88cfaf2f8d1051092e467e12de987bf717164d60", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760395, "uuid": "b7c60004-d898-4168-9d04-ad82375b9335", "comment": "Malware payload (CoinMiner)", "value": "575996d250cc8a84f14f4690ad8758240634a730c0bddbc21b1b054aec23f0c4548b206cb60cd98f17a8330c994852fb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760395, "uuid": "225d4ff4-d82b-424b-bd66-5cc0a33aa07c", "value": "T1326623FD6284336CC41EC974C433F984F276561E4ADAE4BAB2DB36D067A7424D842F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760395, "uuid": "31e55642-274d-4878-910d-f3134f7a1f85", "value": "ad03ae817c87fd74bd29f1c17e69dc64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760395, "uuid": "a0720c18-cb0c-4b93-8832-4faee56442f2", "value": "196608:rBKyvuzV4lgEHF2cC+xHmptrUnwYmr3LnK:rnumlfgF+tG/YY3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760395, "uuid": "a6399900-f63f-4c06-bfd2-514931469cf8", "value": 7017984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760395, "uuid": "ddb3877d-2798-4756-baf4-d002c3046a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760395, "uuid": "ae4d497d-f182-4ca1-8cb2-73c830c27b99", "value": "SecuriteInfo.com.Trojan.Inject4.21377.30820.127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fae4e4-566e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638779219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779219, "uuid": "8dc4a4a1-f80c-466f-95c4-770a3e69f0db", "comment": "Malware payload (Mirai)", "value": "2c8295103cbd209e024bed50411b352e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779219, "uuid": "3aeb10a5-11df-4007-85db-8d8069f32a57", "comment": "Malware payload (Mirai)", "value": "f90a160435e994f41433378a2cea183acb6d2f630ff0861c354c2be87334e80b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779219, "uuid": "fe885c15-fc90-4e70-987a-cfade129eedc", "comment": "Malware payload (Mirai)", "value": "c27e016806c4fa42f8616760ee26f33d45b76f38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638779219, "uuid": "42e38e75-f7c8-4ae2-a386-50006e83053a", "comment": "Malware payload (Mirai)", "value": "de18cd59377b606f4ea66e2d07e528ce34ef6a2b12dfbc30dd381dee6bc08b500c470568c13a330aa3e1a52610bfc86f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779219, "uuid": "d448e716-85ce-4a42-9f5c-c3e0d0214f92", "value": "T1A513E1BC0E428559C813C8BF3B920B702D705EA896426F1A3BD5D4C76E4DAFC356B6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779219, "uuid": "7446488a-6923-4696-ad6f-68cc225da12a", "value": "768:+9k1RLpXp25eEOdaewRg1X/RDC7fRH/lN/l45JgGlzDpbuR1JSwUOGUJB:wTrl1g15+DTVeVJuLT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638779219, "uuid": "4606368e-1f22-4ef9-87d0-79e324be15d3", "value": 41468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638779219, "uuid": "b5f53289-bf1a-4f2b-b023-0ac9ecc14fda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638779219, "uuid": "e2f86153-46d8-4694-9200-397b68530bfc", "value": "2c8295103cbd209e024bed50411b352e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956b7884-56b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638809414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809414, "uuid": "17f12038-cc9e-4615-bbc8-d35262b1dd5d", "comment": "Malware payload (TrickBot)", "value": "58828abb3770c36a0757b2507943cd54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809414, "uuid": "5ee33176-a351-405b-914e-496ee424781a", "comment": "Malware payload (TrickBot)", "value": "f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809414, "uuid": "ca65d5bd-2cbf-4a63-b565-ea620d485a21", "comment": "Malware payload (TrickBot)", "value": "b52b1cfaba2d41fdefd1ff8f4c98801cb8b93620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638809414, "uuid": "f5438a94-9ecf-40a9-af1f-39925f10bddb", "comment": "Malware payload (TrickBot)", "value": "ff2b33ba83583ca992f104aa771e203e083bcdd3cd5bfff411891ae14f0134f56f4f89266fd64dba1d118709752dae36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809414, "uuid": "5f3b5bec-c40c-45b5-86ca-68c2a3c92f44", "value": "T19A9401E667D1BC27F1554CF8929FBFB92608592A4F4C518720907D3EA1B50A2EC32E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809414, "uuid": "294dce76-95bb-4a95-9f9b-70624ad94a4e", "value": "55754e7c2ff4111726a0287744b2114b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809414, "uuid": "44509b7e-287f-4023-bc66-4521f9120598", "value": "6144:koMgXsS8vVr0uBuz7KGW3yv8/fk2SvpLBxGxDDhKg9T0/Q1HN29GBPJs780YWmPF:kopx2ou0aY40/yU4Rs7MWcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638809414, "uuid": "575acb3c-0018-4645-b96f-1f0fcac96d15", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638809414, "uuid": "19696ba3-8b3d-4f45-941a-f4895eb40d07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638809414, "uuid": "39b2b105-eb11-4538-bdc0-5eb06270580d", "value": "f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac79a52-56ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638805987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805987, "uuid": "1342014e-a1b9-42b9-ad23-0adfdfef9851", "comment": "Malware payload (Dridex)", "value": "edd5e7e742a9cf2c2b410d9208278042", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805987, "uuid": "ad12318b-8960-47fd-9f45-9cf637ec1117", "comment": "Malware payload (Dridex)", "value": "fa6aea596a04b6bd957babd156bbd40cafa2b0662390cc2fd30953fb48ec61fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805987, "uuid": "8d5b4970-71d4-434e-990f-7bacf83c8587", "comment": "Malware payload (Dridex)", "value": "f1db2c4189850281f2fa163903750e7e549ee165", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638805987, "uuid": "f6b13664-afd4-4685-9fb4-adafd8549f92", "comment": "Malware payload (Dridex)", "value": "fd64c7ce6d6d696675f5ffcc4abfbd0551a68d002d369348c2e8599c7afe9e464e0b00e585b510965064b22e03ad1234", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805987, "uuid": "9a8f1758-1c4a-4e5f-82de-0d7d5877072c", "value": "T137A4AF469D16A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805987, "uuid": "221a9921-eb2c-4267-85eb-3956e8a68d97", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805987, "uuid": "129f1a3c-74cc-4a52-94d6-96f42dcaf05e", "value": "12288:S7fimEsIsmY4K08oM1Wd8t5KQhNdv5zl:S7aVRBn7x6jt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638805987, "uuid": "53de0d48-0c72-47c3-9e13-ab33b7dcd5cc", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638805987, "uuid": "f97ab039-752c-47d4-a2fa-77f545cadc83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638805987, "uuid": "3e7650e8-f8bb-41dd-801f-ef81fc4e1b59", "value": "edd5e7e742a9cf2c2b410d9208278042.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380bb158-568c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638792077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792077, "uuid": "a2393023-b85d-43c8-97dd-429e79464091", "comment": "Malware payload (RedLineStealer)", "value": "d92025812d4642f4e303f29f39e9915c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792077, "uuid": "44ecb8c3-9215-44d8-b346-3fc647a1dc3b", "comment": "Malware payload (RedLineStealer)", "value": "fae4a37cca9fa9a55c2176ed4b0bb02e655a125e00096a4bfb7d536ca5ff9cb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792077, "uuid": "fae8be27-1b4d-45fe-b88d-a6030c176f76", "comment": "Malware payload (RedLineStealer)", "value": "126cd2508a2bdc3ff57593ce01a1688ec4f7021a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638792077, "uuid": "eab37bdb-ef38-482f-8a4e-1c54b76dfe60", "comment": "Malware payload (RedLineStealer)", "value": "579f64465724f637a5a83cf6306ccb49f3abc2a262d77d69c99f3e554cd283de64e5e19a32f63a4322132d0eceff3ede", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792077, "uuid": "8a217977-e120-43bb-be10-f85be5ddb580", "value": "T10225F001B6B9DA00D8384F30CBA686261E255F877971B3EFE46CB105BB72DB69B105DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792077, "uuid": "59f54b9c-72e4-4a31-9112-7518f75980ab", "value": "4d0adcf378f9c276a723d7d31cd5a423", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792077, "uuid": "cf3550d3-2ede-4483-b245-a7ca027fcb03", "value": "24576:U1iz+br1ha7IYsBRSGhTlBUe4yOKdzxzXmnzA4:UbLa7HeBi98lah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638792077, "uuid": "a1dc6d64-ec85-4579-9d5f-2f9ef3ba425c", "value": 1043632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638792077, "uuid": "e9a9a394-b57a-4aab-89db-dc17f10eefdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638792077, "uuid": "ab1a600f-6e7a-4acf-99d5-360408e3bd08", "value": "d92025812d4642f4e303f29f39e9915c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fd1a03-569a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638798137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798137, "uuid": "5fe41020-322e-4c5a-a96f-7b9028f00df7", "comment": "Malware payload", "value": "d803962bfc4f8011e894baf3747439e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798137, "uuid": "f02e6bd8-4db2-4fb4-b27e-e88a1cf9722c", "comment": "Malware payload", "value": "fb930a8461182b91464a3d5f186b3f4f1045032301449faaa15403ea72e0f58c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798137, "uuid": "6b89fd64-69e4-4d19-8f65-b5b84fc6303a", "comment": "Malware payload", "value": "320e3922bd0ac936126a625a9be5a7de6518b0a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638798137, "uuid": "ddd410f8-0184-4dc8-8131-8b40176dddb5", "comment": "Malware payload", "value": "956c786943408241e219663a7c73abc337aa8ecf88b9c609e99359cdfee035ee06684e13d4c85b99a89b085523206df6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798137, "uuid": "6c5c06e8-1371-4235-bbb6-b46d87688d4c", "value": "T193D4AE1277C1C0B6D56F02314506C71C72F2E9908FFA8687AFD95F2E6EB01D2AB35626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798137, "uuid": "6e8e8a2b-a385-4726-ab61-dd18c36f6743", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798137, "uuid": "19acb88d-0537-42a4-bb50-73919e1c155c", "value": "12288:WKEUkuAOLka1miSmuYr1V7wAobS3qTHPR101:TEQLka1nBVcAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638798137, "uuid": "eaa40ab2-bdb4-42de-bb59-6abd3a08f900", "value": 632223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638798137, "uuid": "b4629d46-e578-43bb-a00f-6e4a1fe4e401", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638798137, "uuid": "dfc5974b-759c-4842-b38e-f05ace4837df", "value": "emotet_exe_e4_fb930a8461182b91464a3d5f186b3f4f1045032301449faaa15403ea72e0f58c_2021-12-06__134212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a44774-5642-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638760401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760401, "uuid": "b4da1868-f83a-4335-96e3-a727e9039273", "comment": "Malware payload (DCRat)", "value": "8322e2545799a1976a2635a40035764a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760401, "uuid": "e7ccc265-c69c-4eb8-9cf3-993c3a20fd4b", "comment": "Malware payload (DCRat)", "value": "fc2efbe9d556ba1bfae20033d0cb3503d4db0f09cce8090baefc78ecb897da49", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760401, "uuid": "50195a48-d98a-412c-b3e2-dde5ad5bdda5", "comment": "Malware payload (DCRat)", "value": "b83b3f868ced6a91bd22211fe2d1f0f396813f51", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638760401, "uuid": "c7681c0f-49c3-4e70-b7f7-89698db24890", "comment": "Malware payload (DCRat)", "value": "b4c18c6120bfdd1e796ab214f585bc0eac15caa95bd610ab6009c71cab24ef4498ddf898810a2aa1d5d713a0c72daee0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760401, "uuid": "56bbe069-df2e-4550-b5e4-5c0e4c7a79c3", "value": "T1218533DC5610CF18C209C1B4D15A6BA904462E20BB29E8178E7F5E1BE6F9487FE3B4F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760401, "uuid": "c5128e4b-ed92-48c7-b219-fd6388c69241", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760401, "uuid": "7dbc742d-07b8-403d-81a2-718ab68b2a9b", "value": "49152:K3rAFe9UIiZ00TzN8kDUJkCptUiFXGFqo5/vNayPQ1:wcAOZdbUuCrwL5NZPQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638760401, "uuid": "f2f3eec4-1ba8-402a-bcc9-38555ffbe064", "value": 1819648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638760401, "uuid": "4a193aeb-adbe-49c0-86af-1dcb35d42cb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638760401, "uuid": "a4d63363-ad74-4b40-b46b-9f32c0f0bcd1", "value": "SecuriteInfo.com.W32.AIDetect.malware2.12916.31560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947acf95-569e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638799963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799963, "uuid": "5fc5f360-2c1a-499f-83d9-8e6e2699af16", "comment": "Malware payload (Dridex)", "value": "6b2035816894454336165a076472f75b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799963, "uuid": "239f55ce-c415-458d-85a0-da300ffd6ecc", "comment": "Malware payload (Dridex)", "value": "fc3f0a97098ad596b964f2092f5bb60c075a9afc6d1b940ec968005314d94de4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799963, "uuid": "cb025d64-a496-42bf-a0e8-220311385b7b", "comment": "Malware payload (Dridex)", "value": "e7ce60a887bd7f7f9a30cf5c1aad0a5532055472", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638799963, "uuid": "bf625a28-0bc5-4da5-9124-13f3480653c8", "comment": "Malware payload (Dridex)", "value": "acf605669f8b0a6a515b4a87d3e1e45fc0a73a8d4c57421e138c9113ac9e14fb9f78ab36b7cb3f58b1da505b7439089a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799963, "uuid": "e38bfa30-3cc8-41a3-8d7d-dc813344bd62", "value": "T19AA4AF6CFCEBB436C411C7F0987793990D352619E3FFE6E0362B9087A75A6600A4589F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799963, "uuid": "87606a5a-15ff-436a-91cf-43d9293a7e08", "value": "5293be9dcc3fe4423188dd90c7dd2d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799963, "uuid": "024ad045-4c36-4942-95b9-94667add3e93", "value": "12288:3QG80io88EmEkECG2EGoyEW+DBY49h4oJIH7ln:AG80io88EmEkECG2EGoyEW++HKyln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638799963, "uuid": "997b33e3-b663-4ef4-ac46-0c30bc26e064", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638799963, "uuid": "d0ed51d3-4f91-43ef-b7a6-4b4be6ff1e2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638799963, "uuid": "9502d0cd-0146-48ac-a177-6d33f4f4ee06", "value": "6b2035816894454336165a076472f75b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edd805b-5660-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638773218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773218, "uuid": "8deb1c43-3687-44de-a963-0cd749a04368", "comment": "Malware payload", "value": "05660cefd4d77c58a4d020863d30c502", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773218, "uuid": "2e6298ce-a7e0-4e99-9972-f00f6f46d970", "comment": "Malware payload", "value": "fcc2f1684b8309bf79268d688e36f517681fff88abb435e2983c27a7cafc8924", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773218, "uuid": "5cadcd79-3d94-45ff-ae95-5581ab2a3ffe", "comment": "Malware payload", "value": "6d3a99777af2ab4a1e12855503351085e9eca299", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638773218, "uuid": "b3515535-190f-4617-8158-cdd4a05d1ea0", "comment": "Malware payload", "value": "c4c3f54b1ce53bba1cb12f5584f88d12ef5b571e62df38b2ef125a1f7b6220853a65a578da1a92a5b6948f826906b71e", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773218, "uuid": "4afbca3b-eb98-4e61-b08e-80a4a35e8b44", "value": "T1E472C0BCF20E3540EFA365F492FE82DD9E7799B7857C9632C1A1286E170251F29057C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773218, "uuid": "1122af06-55dc-456b-9c90-af24526e5a97", "value": "384:jSPRh2g0pvrZ7zz7GZIyULBrbs02KBRHI8Y3vj:2PRUhl8aPSKBRHI8Avj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638773218, "uuid": "a488bcae-d8f4-40c3-846c-b35e7bcc7e88", "value": 16436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638773218, "uuid": "8d039791-595c-40cc-8f38-357eed17cef3", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638773218, "uuid": "727397c0-3e13-4ca1-8838-85549b7a247d", "value": "new order 122001-220 Guangzhou.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057f9a65-56a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638802300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802300, "uuid": "57ada5b3-8440-4e6d-b2e0-75c696e3873b", "comment": "Malware payload (Dridex)", "value": "8735ca778f0d80a43d44af1ce110ce5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802300, "uuid": "21e55792-90a0-44c9-b02d-444d260866ca", "comment": "Malware payload (Dridex)", "value": "fd7658cdf31389ef24c2767f2f909a4b71de55a1232e84c0575675df7bb2faf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802300, "uuid": "468e9e5f-5148-4952-ab5d-0d64fe5cbe72", "comment": "Malware payload (Dridex)", "value": "11f5c8375add0fe72857eb375e6beef2da9a685c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638802300, "uuid": "8b007a90-d585-444e-943c-e9d9e78a04c3", "comment": "Malware payload (Dridex)", "value": "fa9a8cd2046717cc8254b670e90f2c2ba7fb35b01c9e46794081117ee21fb87793c2975e54656b46be65861e3f260aaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802300, "uuid": "1c1bd622-c9fd-4880-89c9-e5c126c2047f", "value": "T1F2A4AF469D16A00DE80DA43DB24CB29AE9F862F7F57861F3542EB33E2DD30928F17459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802300, "uuid": "a92f7e41-6a55-460b-8335-90cecf1bdc58", "value": "03540fe05cb0473f2f956a0d0a682262", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802300, "uuid": "027cc6e8-83f8-4895-8f1f-83c2aff7fa58", "value": "12288:m7fimEsIsmY4K08oM1Wd8t5KQhNdv5zw:m7aVRBn7x6jt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638802300, "uuid": "6cd915c9-9145-432e-b800-071a7c7101d4", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638802300, "uuid": "9a5adf12-3797-4f86-b55b-8e4d10a392ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638802300, "uuid": "fc65543c-c768-48bc-befa-824125a08ada", "value": "8735ca778f0d80a43d44af1ce110ce5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af790b5-56b3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638808833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808833, "uuid": "5bd34598-32ce-45d6-b085-53974f5d9b86", "comment": "Malware payload (Formbook)", "value": "7d277171c84ef4dd88bbf0dba79cd725", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808833, "uuid": "2062bd61-3702-4aa3-9004-b4a3679e25eb", "comment": "Malware payload (Formbook)", "value": "fd7d542aa6e922020e6fb15fc151be03a967ca01b09c75cd267302b873f1a79c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808833, "uuid": "312d4b3d-7645-4388-8ef5-2855472a1534", "comment": "Malware payload (Formbook)", "value": "2b1cf7ee61b336d8774697781902a273bd6ca4cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638808833, "uuid": "f4113b9a-bd6f-4a21-9766-74df0e1593d2", "comment": "Malware payload (Formbook)", "value": "affb4ff99331106cd5f656e62eff563497f6e5d839cf7456630ab6168ba9d1dbdcf9c8f09d95ceea02d6916250490589", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808833, "uuid": "e8fe1351-8c22-451c-9ec9-bd84a60e67b2", "value": "T1AD555A5C317025AFE83A853145540F379EF12C7D866B93CE7317349F8ABA9868F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808833, "uuid": "9541f2d1-b351-44ae-903a-4355c8b27601", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808833, "uuid": "ca5197e5-f07b-4253-8901-1ff98a07f83e", "value": "24576:7Yj1PMYz8LUDr8RLyHPX9r2gyPOGSKw50wkO8tKCw59nkIU7KYDSV:7IPkLUDrXPNygyWaw5cO8tFw59d87DSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638808833, "uuid": "f7177a6f-5593-4300-ae52-e2a72db2c9d6", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638808833, "uuid": "4546ba94-d253-417a-9dd8-0f75ac9b572d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638808833, "uuid": "dcb10b68-80d8-43b0-b2a9-1d338bff4b3a", "value": "7d277171c84ef4dd88bbf0dba79cd725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2268c00a-566c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638778297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778297, "uuid": "1110bc01-9b44-4cea-87c1-7ea9f7556966", "comment": "Malware payload (Mirai)", "value": "20f0737c73b39c5e256aaa2c176cbf84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778297, "uuid": "bd8822b7-8e31-4acf-a582-3977fee763b3", "comment": "Malware payload (Mirai)", "value": "fe60bbd8b0779ac6de9b6173a625c7906bb908d0703915d0859bc7a6ea926130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778297, "uuid": "9c8f8449-3e46-450a-a118-6d91ee286b88", "comment": "Malware payload (Mirai)", "value": "a2f38f9592c552ed6a840cef9c3ec88c884b9c5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638778297, "uuid": "51449c21-1a58-4e52-810f-fa6cb62f66c2", "comment": "Malware payload (Mirai)", "value": "e4ae82275e68a941f543553fc60a781e18db21e256ad06b0aee5949645dcc8bad5f25c95ffd6332d633f5eff1e1bca38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778297, "uuid": "6fd67f00-d0ab-4477-a7d3-dad6d69dd3cb", "value": "T1E833F19DD128204E8D9C1CBF91FE03F9E759B245FC5AAB0CE81041C1A7971ABB8F6835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778297, "uuid": "b8cdde26-072b-45f7-9b50-9cc9828be1ec", "value": "1536:e5NM8vbVjQ6Bg6wSRhJfntVax6rkv1pWYLp:e5NlVE6N1ax6wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638778297, "uuid": "64909a7a-e1f0-465c-81e7-59b7d8bb1549", "value": 53356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638778297, "uuid": "e640d2c7-5102-4191-90bc-872de185b380", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638778297, "uuid": "b14ce849-6c5c-44d5-8424-69b27e116a1e", "value": "20f0737c73b39c5e256aaa2c176cbf84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }